Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1639583
MD5:	38da35e91c9aeea07d77b7df32e30591
SHA1:	49eebb6f1db4065b62e276f61c6f2c6abc0cb66e
SHA256:	53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e
Tags:	exeuser-Bitsight
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6832 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 38DA35E91C9AEEA07D77B7DF32E30591)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 6964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

chrome.exe (PID: 6208 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,15293753799897546638,14223410568821553602,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7644 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1576 --field-trial-handle=1916,i,2447333108888660332,14346485730295745683,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4340 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,10611571270307567122,8227078237677590620,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

WerFault.exe (PID: 6084 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 2776 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 8108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,11077271955637265282,249532908686684789,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5724 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8292 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7044 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8668 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7008 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199832267488", "Botnet": "dqu220"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1fcca:$str01: MachineID: 0x1ef53:$str02: Work Dir: In memory 0x1fd01:$str03: [Hardware] 0x1fcb3:$str04: VideoCard: 0x1f6b5:$str05: [Processes] 0x1f6c1:$str06: [Software] 0x1efd0:$str07: information.txt 0x1fa36:$str08: %s\* 0x1fa83:$str08: %s\* 0x1f206:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1f59f:$str12: UseMasterPassword 0x1fd0d:$str13: Soft: WinSCP 0x1f7eb:$str14: <Pass encoding="base64"> 0x1fcf0:$str15: Soft: FileZilla 0x1efc2:$str16: passwords.txt 0x1f5ca:$str17: build_id 0x1f679:$str18: file_data
Process Memory Space: MSBuild.exe PID: 6964	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.MSBuild.exe.400000.0.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1fcca:$str01: MachineID: 0x1ef53:$str02: Work Dir: In memory 0x1fd01:$str03: [Hardware] 0x1fcb3:$str04: VideoCard: 0x1f6b5:$str05: [Processes] 0x1f6c1:$str06: [Software] 0x1efd0:$str07: information.txt 0x1fa36:$str08: %s\* 0x1fa83:$str08: %s\* 0x1f206:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1f59f:$str12: UseMasterPassword 0x1fd0d:$str13: Soft: WinSCP 0x1f7eb:$str14: <Pass encoding="base64"> 0x1fcf0:$str15: Soft: FileZilla 0x1efc2:$str16: passwords.txt 0x1f5ca:$str17: build_id 0x1f679:$str18: file_data
2.2.MSBuild.exe.400000.0.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1e2ca:$str01: MachineID: 0x1d553:$str02: Work Dir: In memory 0x1e301:$str03: [Hardware] 0x1e2b3:$str04: VideoCard: 0x1dcb5:$str05: [Processes] 0x1dcc1:$str06: [Software] 0x1d5d0:$str07: information.txt 0x1e036:$str08: %s\* 0x1e083:$str08: %s\* 0x1d806:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1db9f:$str12: UseMasterPassword 0x1e30d:$str13: Soft: WinSCP 0x1ddeb:$str14: <Pass encoding="base64"> 0x1e2f0:$str15: Soft: FileZilla 0x1d5c2:$str16: passwords.txt 0x1dbca:$str17: build_id 0x1dc79:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 149.154.167.99, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6964, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49681

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 6964, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 6208, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T23:03:12.380315+0100	2044247	1	Malware Command and Control Activity Detected	78.47.63.132	443	192.168.2.7	49685	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T23:03:13.704673+0100	2051831	1	Malware Command and Control Activity Detected	78.47.63.132	443	192.168.2.7	49686	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T23:03:13.704468+0100	2049087	1	A Network Trojan was detected	192.168.2.7	49686	78.47.63.132	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T23:03:15.088957+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49687	78.47.63.132	443	TCP
2025-03-15T23:03:16.513467+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49688	78.47.63.132	443	TCP
2025-03-15T23:03:16.833330+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49689	78.47.63.132	443	TCP
2025-03-15T23:03:17.787767+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49690	78.47.63.132	443	TCP
2025-03-15T23:03:18.989094+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49691	78.47.63.132	443	TCP
2025-03-15T23:03:27.774448+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49718	78.47.63.132	443	TCP
2025-03-15T23:03:29.164326+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49722	78.47.63.132	443	TCP
2025-03-15T23:03:29.199060+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49721	78.47.63.132	443	TCP
2025-03-15T23:03:30.194612+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49723	78.47.63.132	443	TCP
2025-03-15T23:03:31.293963+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49724	78.47.63.132	443	TCP
2025-03-15T23:03:51.411177+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49776	78.47.63.132	443	TCP
2025-03-15T23:03:52.224086+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49789	78.47.63.132	443	TCP
2025-03-15T23:03:53.256915+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49814	78.47.63.132	443	TCP
2025-03-15T23:03:55.450710+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49834	78.47.63.132	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T23:03:16.833330+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49689	78.47.63.132	443	TCP
2025-03-15T23:03:17.787767+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49690	78.47.63.132	443	TCP
2025-03-15T23:03:18.989094+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49691	78.47.63.132	443	TCP
2025-03-15T23:03:29.164326+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49722	78.47.63.132	443	TCP
2025-03-15T23:03:30.194612+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49723	78.47.63.132	443	TCP
2025-03-15T23:03:31.293963+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49724	78.47.63.132	443	TCP
2025-03-15T23:03:52.224086+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49789	78.47.63.132	443	TCP
2025-03-15T23:03:53.256915+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49814	78.47.63.132	443	TCP
2025-03-15T23:03:55.450710+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49834	78.47.63.132	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T23:03:09.760882+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.7	49683	78.47.63.132	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.MSBuild.exe.400000.0.raw.unpack

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199832267488", "Botnet": "dqu220"}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 19%			Perma Link
Source: file.exe	ReversingLabs: Detection: 16%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406A10 StrStrA,lstrlenA,LocalAlloc,CryptUnprotectData,LocalAlloc,LocalFree,lstrlenA,	2_2_00406A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00410830 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree,	2_2_00410830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A150 BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptCloseAlgorithmProvider,	2_2_0040A150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406CF0 LocalAlloc,BCryptDecrypt,	2_2_00406CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406940 BCryptCloseAlgorithmProvider,BCryptDestroyKey,	2_2_00406940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A560 StrCmpCA,BCryptCloseAlgorithmProvider,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptDestroyKey,	2_2_0040A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406980 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,BCryptCloseAlgorithmProvider,BCryptDestroyKey,	2_2_00406980

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.7:49682 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A1358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7531A1358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A11D4 FindFirstFileExW,	0_2_00007FF7531A11D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407210 ExpandEnvironmentStringsA,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,CopyFileA,DeleteFileA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose,	2_2_00407210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B6B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindClose,	2_2_0040B6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408360 FindFirstFileA,CopyFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindClose,	2_2_00408360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004097B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,	2_2_004097B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414E70 wsprintfA,FindFirstFileA,DeleteFileA,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose,	2_2_00414E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040ACD0 wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,lstrlenA,DeleteFileA,CopyFileA,FindClose,	2_2_0040ACD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408C90 lstrcpyA,lstrcatA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose,FindClose,DeleteFileA,_invalid_parameter_noinfo_noreturn,	2_2_00408C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00415EB0 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindClose,	2_2_00415EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414950 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,strlen,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409560 ??2@YAPAXI@Z,??2@YAPAXI@Z,_invalid_parameter_noinfo_noreturn,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,	2_2_00409560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413FD0 wsprintfA,FindFirstFileA,FindNextFileA,strlen,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose,	2_2_00413FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004013F0 FindFirstFileA,FindClose,FindNextFileA,strlen,FindFirstFileA,DeleteFileA,FindNextFileA,CopyFileA,CopyFileA,DeleteFileA,FindClose,	2_2_004013F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413580 wsprintfA,FindFirstFileA,memset,memset,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindClose,	2_2_00413580

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00413AF0 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

2_2_00413AF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.7:49683 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.7:49686 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49687 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49721 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49688 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49689 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49689 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49718 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49722 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49722 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 78.47.63.132:443 -> 192.168.2.7:49686
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49724 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49724 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49690 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49690 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49691 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49691 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49776 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 78.47.63.132:443 -> 192.168.2.7:49685
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49789 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49789 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49834 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49834 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49723 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49723 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49814 -> 78.47.63.132:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49814 -> 78.47.63.132:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199832267488

Source: global traffic

HTTP traffic detected: GET /g_etcontent HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 52.168.117.175 52.168.117.175
Source: Joe Sandbox View	IP Address: 2.22.242.11 2.22.242.11
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.175
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.152.9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00403850 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

2_2_00403850

Source: global traffic	HTTP traffic detected: GET /g_etcontent HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0Host: t.p.formaxprime.co.ukConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.cb278af4d754dd8a1a58.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=A6701706864E412ABBF0E9E1CF90AF38.RefC=2025-03-15T22:03:45Z; USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; MUIDB=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.948ffa5ea2d441a35f55.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=A6701706864E412ABBF0E9E1CF90AF38.RefC=2025-03-15T22:03:45Z; USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; MUIDB=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.08ddc3af8246ad2193cd.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.1ed6fad3ee8a8960478c.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.f2bbb948ce12d0d1625c.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.8704366d527afd4c1c1c.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Ad_brx23lef_cW590ESOTTAroOhZ9si0XFJIUC52j2ILHW1VLB5ou6c0RgLWwGr1aRJJZ0WPNyiPBYgIpWfykvhKW-6BLzMRsp9ykw5f6ReBQmPpO6WB9pcSJPfykLTHDjYAxlKa5bf72z8tHS5eXuTavTP1h4WZBjSs/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1742076230513&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a6701706864e412abbf0e9e1cf90af38&activityId=a6701706864e412abbf0e9e1cf90af38&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1742076230514&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=06898F1A137E61ED2A909AAA12D66026&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1742076230514&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=06898F1A137E61ED2A909AAA12D66026&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=184aec4ece667d50c8349e61742076232; XID=184aec4ece667d50c8349e61742076232
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.75sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=A6701706864E412ABBF0E9E1CF90AF38.RefC=2025-03-15T22:03:45Z; USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; MUIDB=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=f894a01a-65a1-42cd-84d2-bac763fe6a80; ai_session=qBH2uQSGXtetv6P0L1uXGB\|1742076230508\|1742076230508; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=A6701706864E412ABBF0E9E1CF90AF38.RefC=2025-03-15T22:03:45Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":37,"imageId":"BB1msMCf","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=A6701706864E412ABBF0E9E1CF90AF38.RefC=2025-03-15T22:03:45Z; USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; MUIDB=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=f894a01a-65a1-42cd-84d2-bac763fe6a80; ai_session=qBH2uQSGXtetv6P0L1uXGB\|1742076230508\|1742076230508; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=A6701706864E412ABBF0E9E1CF90AF38.RefC=2025-03-15T22:03:45Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1742076230513&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a6701706864e412abbf0e9e1cf90af38&activityId=a6701706864e412abbf0e9e1cf90af38&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A8E397131C874C1FAC7B2D8BF332CDF5&MUID=06898F1A137E61ED2A909AAA12D66026 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=06898F1A137E61ED2A909AAA12D66026; _EDGE_S=F=1&SID=1D0F47763CCD6A8D038A52C63D7F6B88; _EDGE_V=1; SM=T

Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.976791093.000009CC03604000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.983871203.000009CC02514000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
Source: chrome.exe, 00000003.00000003.976791093.000009CC03604000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.983871203.000009CC02514000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: t.p.formaxprime.co.uk
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----900h4wl68q1djm7ymglxUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0Host: t.p.formaxprime.co.ukContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1201681443.0000788000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1201681443.0000788000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1201681443.0000788000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1201681443.0000788000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.1001655338.000009CC034C4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: Amcache.hve.32.dr	String found in binary or memory: http://upx.sf.net
Source: chromecache_445.4.dr	String found in binary or memory: http://www.broofa.com
Source: h4euai.2.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: chrome.exe, 00000003.00000003.1010544983.000009CC02980000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001438598.000009CC02980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chromecache_443.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_443.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp, chromecache_445.4.dr, chromecache_443.4.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000008.00000002.1104415049.0000022BCBD57000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1271888229.00000226B2482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: json[1].json.2.dr	String found in binary or memory: https://assets.msn.com/statics/icons/favicon_newtabpage.png
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.15.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000003.00000003.984027708.000009CC03624000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001718973.000009CC03514000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001786497.000009CC02794000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com
Source: h4euai.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: offscreendocument_main.js.14.dr, service_worker_bin_prod.js.14.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: MSBuild.exe, 00000002.00000002.1380480797.0000000003BD7000.00000004.00000020.00020000.00000000.sdmp, h4euai.2.dr, Web Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.1380480797.0000000003BD7000.00000004.00000020.00020000.00000000.sdmp, h4euai.2.dr, Web Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.1010108435.000009CC03A64000.00000004.00001000.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.1107046665.000078E80017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1302551154.000078800017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.14.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000003.00000003.976522721.000009CC03368000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001595220.000009CC038EC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010108435.000009CC03A64000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.966178523.000009C800504000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.966178523.000009C800504000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.966162642.000009C8004E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966102403.000009C8004D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000008.00000002.1107046665.000078E80017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1302551154.000078800017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.14.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 0000000C.00000002.1302551154.000078800017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/https://chrome.google.com/webstorex
Source: 53ec8dce-f773-41e1-8b5d-8921ed252e7c.tmp.15.dr	String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 00000003.00000003.960177709.00005410000DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: msedge.exe, 00000008.00000002.1106603419.000078E800040000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1298254974.0000788000054000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.14.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 53ec8dce-f773-41e1-8b5d-8921ed252e7c.tmp.15.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_443.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_443.4.dr	String found in binary or memory: https://content.googleapis.com
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.14.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chromecache_443.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive.google.com/
Source: h4euai.2.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000002.00000002.1380480797.0000000003BD7000.00000004.00000020.00020000.00000000.sdmp, h4euai.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: h4euai.2.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log2.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log2.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log1.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log2.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.14.dr, 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000003.00000003.984963946.000009CC03758000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.985391847.000009CC03704000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.984963946.000009CC03780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.google.com/icons?selected=Material
Source: chromecache_445.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_445.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_445.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_445.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://gaana.com/
Source: h4euai.2.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glic/intro?20
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glic2
Source: chrome.exe, 00000003.00000003.966102403.000009C8004D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.966162642.000009C8004E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966102403.000009C8004D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.966162642.000009C8004E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966102403.000009C8004D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Pre
Source: chrome.exe, 00000003.00000003.966066378.000009C8004CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.966102403.000009C8004D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: msedge.exe, 0000000C.00000002.1304412191.00007880002C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000003.1010660098.000009CC03E84000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: n7glxt.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chrome.exe, 00000003.00000003.984027708.000009CC03624000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001786497.000009CC02794000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/gen204
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://m.kugou.com/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: msedge.exe, 0000000C.00000002.1304412191.00007880002C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000C.00000002.1304412191.00007880002C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.15.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.15.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://music.amazon.com
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://music.apple.com
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000003.00000003.976559785.000009CC03378000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log10.14.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log4.14.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log4.14.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.14.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.14.dr, 000003.log4.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log4.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13386549825537769.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.14.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: msedge.exe, 0000000C.00000002.1304412191.00007880002C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.1010008825.000009CC03538000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://open.spotify.com
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: chrome.exe, 00000003.00000003.984027708.000009CC03624000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001786497.000009CC02794000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/calendar/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000008.00000003.1089167177.000078E8001D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/events
Source: msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chromecache_445.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_443.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_443.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000003.00000003.976559785.000009CC03378000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: MSBuild.exe, MSBuild.exe, 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199832267488
Source: MSBuild.exe, 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199832267488dqu220Mozilla/5.0
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/?
Source: MSBuild.exe, MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1378907264.0000000000E48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g_etcontent
Source: MSBuild.exe, 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g_etcontentdqu220Mozilla/5.0
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/7wner3.default-release
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/G
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/I
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/W
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/ac
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/l
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/qL
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk/s
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk:
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.uk?
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.p.formaxprime.co.ukj
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://tidal.com/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://web.telegram.org/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://web.whatsapp.com
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_443.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.deezer.com/
Source: MSBuild.exe, 00000002.00000002.1380480797.0000000003BD7000.00000004.00000020.00020000.00000000.sdmp, h4euai.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: chrome.exe, 00000003.00000003.1010108435.000009CC03A64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.976559785.000009CC03378000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content_new.js.14.dr, content.js.14.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: MSBuild.exe, 00000002.00000002.1380480797.0000000003BD7000.00000004.00000020.00020000.00000000.sdmp, h4euai.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Web Data.14.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chromecache_443.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_443.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000003.00000003.1010918401.000009CC03C04000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010824628.000009C800624000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chromecache_445.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_445.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_445.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.1010191527.000009CC036BC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010381083.000009CC03B4C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.eebVy_fNKiM.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.sDa5bc0wD58.L.W.O/m=qmd
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.instagram.com
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.last.fm/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.messenger.com
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.office.com
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.tiktok.com/
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://www.youtube.com
Source: 2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.63.132:443 -> 192.168.2.7:49682 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00410A90 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,malloc,StrCmpCW,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00410A90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00406480 memcpy,OpenDesktopA,CreateDesktopA,lstrcpyA,CreateProcessA,Sleep,CloseDesktop,

2_2_00406480

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A72EC	0_2_00007FF7531A72EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318F440	0_2_00007FF75318F440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753192450	0_2_00007FF753192450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753197880	0_2_00007FF753197880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753194060	0_2_00007FF753194060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531908E0	0_2_00007FF7531908E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318BB40	0_2_00007FF75318BB40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753184790	0_2_00007FF753184790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A1358	0_2_00007FF7531A1358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753182B70	0_2_00007FF753182B70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753191FA0	0_2_00007FF753191FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753191BB0	0_2_00007FF753191BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318D3F0	0_2_00007FF75318D3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753182640	0_2_00007FF753182640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A7A6C	0_2_00007FF7531A7A6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318C2C0	0_2_00007FF75318C2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753195AD0	0_2_00007FF753195AD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753194AD0	0_2_00007FF753194AD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753183ED0	0_2_00007FF753183ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75319A29C	0_2_00007FF75319A29C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318F710	0_2_00007FF75318F710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A9708	0_2_00007FF7531A9708
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753186EE0	0_2_00007FF753186EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318D920	0_2_00007FF75318D920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75318DD60	0_2_00007FF75318DD60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753190170	0_2_00007FF753190170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A11D4	0_2_00007FF7531A11D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753195E00	0_2_00007FF753195E00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753194DE0	0_2_00007FF753194DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531951F0	0_2_00007FF7531951F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00404A20	2_2_00404A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00418630	2_2_00418630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B770	2_2_0041B770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B300	2_2_0041B300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041C100	2_2_0041C100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004193D0	2_2_004193D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041A7D0	2_2_0041A7D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410D00 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040F5B0 appears 135 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 2776

Source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: file.exe

Static PE information: Section: .bss ZLIB complexity 1.0003622159090908

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/291@30/24

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00410230 CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,

2_2_00410230

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\AZ5N9PKP.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6964

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\4581bab3-27fd-4c25-b636-434a9cca70dc.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kno8yc26x.2.dr, glf379z5p.2.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 19%
Source: file.exe	ReversingLabs: Detection: 16%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,15293753799897546638,14223410568821553602,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,11077271955637265282,249532908686684789,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1576 --field-trial-handle=1916,i,2447333108888660332,14346485730295745683,262144 /prefetch:3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,10611571270307567122,8227078237677590620,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7044 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 2776
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7008 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2308,i,15293753799897546638,14223410568821553602,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2476 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1576 --field-trial-handle=1916,i,2447333108888660332,14346485730295745683,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,11077271955637265282,249532908686684789,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2224,i,10611571270307567122,8227078237677590620,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7044 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7008 --field-trial-handle=2088,i,11204622022202113914,5734698100804861925,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004108E0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004108E0

Source: file.exe	Static PE information: section name: .gxfg
Source: file.exe	Static PE information: section name: .retplne
Source: file.exe	Static PE information: section name: _RDATA

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_004108E0

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A1358 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7531A1358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531A11D4 FindFirstFileExW,	0_2_00007FF7531A11D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407210 ExpandEnvironmentStringsA,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,CopyFileA,DeleteFileA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose,	2_2_00407210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B6B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindClose,	2_2_0040B6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408360 FindFirstFileA,CopyFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindClose,	2_2_00408360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004097B0 FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,	2_2_004097B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414E70 wsprintfA,FindFirstFileA,DeleteFileA,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose,	2_2_00414E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040ACD0 wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strlen,lstrlenA,DeleteFileA,CopyFileA,FindClose,	2_2_0040ACD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408C90 lstrcpyA,lstrcatA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,CopyFileA,FindFirstFileA,FindNextFileA,strlen,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,FindClose,FindClose,DeleteFileA,_invalid_parameter_noinfo_noreturn,	2_2_00408C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00415EB0 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindClose,	2_2_00415EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414950 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,strlen,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409560 ??2@YAPAXI@Z,??2@YAPAXI@Z,_invalid_parameter_noinfo_noreturn,FindFirstFileA,FindNextFileA,strlen,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,	2_2_00409560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413FD0 wsprintfA,FindFirstFileA,FindNextFileA,strlen,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindClose,	2_2_00413FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004013F0 FindFirstFileA,FindClose,FindNextFileA,strlen,FindFirstFileA,DeleteFileA,FindNextFileA,CopyFileA,CopyFileA,DeleteFileA,FindClose,	2_2_004013F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413580 wsprintfA,FindFirstFileA,memset,memset,FindNextFileA,strlen,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindClose,	2_2_00413580

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00413AF0 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

2_2_00413AF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0040FDD0 GetSystemInfo,wsprintfA,

2_2_0040FDD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe, 00000003.00000003.1012275836.0000023805E0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 34% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory In
Source: Amcache.hve.32.dr	Binary or memory string: VMware
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.14.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.14.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.32.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1378907264.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chrome.exe, 00000003.00000003.1010437300.0000023805D9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812H
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.14.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.32.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.14.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Amcache.hve.32.dr	Binary or memory string: vmci.sys
Source: Web Data.14.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.14.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.14.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.32.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.32.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.32.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.32.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Web Data.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.32.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.32.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.32.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.32.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.32.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.32.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.32.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Web Data.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.32.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.32.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.32.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.32.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.32.dr	Binary or memory string: VMware20,1hbin@
Source: chrome.exe, 00000003.00000003.1010476244.0000023805D73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transit
Source: Amcache.hve.32.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.32.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: chrome.exe, 00000003.00000003.1010476244.0000023805D73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB
Source: Amcache.hve.32.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: chrome.exe, 00000003.00000003.968335692.000009CC02500000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.32.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.32.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: msedge.exe, 00000008.00000002.1103746965.0000022BC9E53000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1271810578.00000226B2444000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.14.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.32.dr	Binary or memory string: vmci.syshbin`
Source: chrome.exe, 00000003.00000003.1012347939.0000023805D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Costmber]
Source: Amcache.hve.32.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Web Data.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5m
Source: chrome.exe, 00000003.00000003.1010476244.0000023805D73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root
Source: Amcache.hve.32.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.32.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Web Data.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Web Data.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF75319AB04 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF75319AB04

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_004108E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF75319E2EC GetProcessHeap,

0_2_00007FF75319E2EC

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753198088 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF753198088
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF75319AB04 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF75319AB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF753198704 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF753198704
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7531986F4 SetUnhandledExceptionFilter,	0_2_00007FF7531986F4

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411310 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,		2_2_00411310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411250 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle,		2_2_00411250

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 426000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 427000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 428000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C29008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7531A9520 cpuid

0_2_00007FF7531A9520

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,GetLocaleInfoA,LocalFree,

2_2_0040FC20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF753198570 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF753198570

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417210 EntryPoint,lstrlenW,GetWindowsDirectoryW,GetComputerNameW,GetFullPathNameA,GetUserNameW,GetFileType,GetModuleFileNameA,GetTempPathW,

2_2_00417210

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0040FBC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_0040FBC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.32.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.32.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.32.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.32.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.32.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6964, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3 Wallet
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|
Source: MSBuild.exe, 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|Daedalus Mainnet\wallets\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Source: Yara match	File source: 00000002.00000002.1378907264.0000000000EA2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6964, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6964, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	411 Process Injection	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	19%	Virustotal		Browse
file.exe	17%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://permanently-removed.invalid/v1/events	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/oauth2/v4/token	0%	Avira URL Cloud	safe
https://anglebug.com/7246	0%	Avira URL Cloud	safe
https://anglebug.com/7714	0%	Avira URL Cloud	safe
https://excel.new?from=EdgeM365Shoreline	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/oauth2/v2/tokeninfo	0%	Avira URL Cloud	safe
http://anglebug.com/7553	0%	Avira URL Cloud	safe
http://anglebug.com/5281	0%	Avira URL Cloud	safe
https://anglebug.com/7489	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/chrome/blank.html	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/v1/issuetoken	0%	Avira URL Cloud	safe
http://anglebug.com/5371	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/reauth/v1beta/users/	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/LogoutYxAB	0%	Avira URL Cloud	safe
https://permanently-removed.invalid/RotateBoundCookies	0%	Avira URL Cloud	safe
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://anglebug.com/7556	0%	Avira URL Cloud	safe
http://anglebug.com/3862	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ax-0003.ax-msedge.net	150.171.27.12	true	false	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	216.58.206.78	true	false	high
a416.dscd.akamai.net	2.22.242.11	true	false	high
ax-0002.ax-msedge.net	150.171.28.11	true	false	unknown
t.p.formaxprime.co.uk	78.47.63.132	true	true	unknown
t.me	149.154.167.99	true	false	high
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	13.74.129.1	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
pki-goog.l.google.com	142.250.185.163	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
a233.dscd.akamai.net	2.22.242.89	true	false	high
fg.microsoft.map.fastly.net	199.232.210.172	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	true	false	high
play.google.com	142.250.185.238	true	false	high
sb.scorecardresearch.com	18.244.18.32	true	false	high
www.google.com	142.250.186.132	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
c.pki.goog	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1742076232410&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1742076233408&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://t.me/g_etcontent	false	high
https://sb.scorecardresearch.com/b?rn=1742076230514&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=06898F1A137E61ED2A909AAA12D66026&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.14.dr	false		high
https://duckduckgo.com/ac/?q=	h4euai.2.dr, Web Data.14.dr	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log4.14.dr	false		high
https://ntp.msn.com/_default	QuotaManager.14.dr	false		high
http://anglebug.com/4633	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/events	msedge.exe, 00000008.00000003.1089167177.000078E8001D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/284462263	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.14.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.14.dr	false		high
https://docs.google.com/	manifest.json0.14.dr	false		high
https://www.youtube.com	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://anglebug.com/7714	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.instagram.com	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
http://anglebug.com/6248	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
http://anglebug.com/6929	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.y.qq.com/n2/m/index.html	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://www.deezer.com/	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://issuetracker.google.com/255411748	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org/	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7246	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7369	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.1010108435.000009CC03A64000.00000004.00001000.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.1107046665.000078E80017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1302551154.000078800017C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	offscreendocument_main.js.14.dr, service_worker_bin_prod.js.14.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.14.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	h4euai.2.dr, Web Data.14.dr	false		high
https://issuetracker.google.com/161903006	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.14.dr	false		high
https://excel.new?from=EdgeM365Shoreline	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.14.dr	false		high
https://plus.google.com	chromecache_443.4.dr	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3078	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5375	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5371	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4722	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/LogoutYxAB	msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7556	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	msedge.exe, 00000008.00000002.1107046665.000078E80017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.1302551154.000078800017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.14.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	MSBuild.exe, 00000002.00000002.1378907264.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, n7glxt.2.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.14.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.14.dr	false		high
https://msn.comXIDv10	Cookies.15.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.14.dr	false		high
https://bard.google.com/	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
https://gemini.google.com/app?q=	h4euai.2.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000008.00000003.1093832738.000078E800270000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.1096821728.000078E800274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200376307.0000788000274000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.1200142603.0000788000270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6692	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
http://anglebug.com/3625	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
http://anglebug.com/3624	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.14.dr, 000003.log4.14.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.976522721.000009CC03368000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001595220.000009CC038EC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010108435.000009CC03A64000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tidal.com/	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://ntp.msn.com	000003.log10.14.dr	false		high
https://lens.google.com/gen204	chrome.exe, 00000003.00000003.984027708.000009CC03624000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1001786497.000009CC02794000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199832267488dqu220Mozilla/5.0	MSBuild.exe, 00000002.00000002.1378643031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://msn.com/	msedge.exe, 0000000C.00000002.1304412191.00007880002C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	MSBuild.exe, 00000002.00000002.1380480797.0000000003BD7000.00000004.00000020.00020000.00000000.sdmp, h4euai.2.dr	false		high
http://anglebug.com/4384	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gaana.com/	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/compose?isExtension=true	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
http://anglebug.com/3970	msedge.exe, 0000000C.00000003.1200710184.000078800043C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/	chrome.exe, 00000003.00000003.976559785.000009CC03378000.00000004.00001000.00020000.00000000.sdmp	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp.14.dr	false		high
https://apis.google.com	chrome.exe, 00000003.00000003.1010210708.000009CC03B7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010330586.000009CC03B6C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010210708.000009CC03B5C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010264471.000009CC03B64000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010447494.000009CC03B1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.1010491221.000009CC03B98000.00000004.00001000.00020000.00000000.sdmp, chromecache_445.4.dr, chromecache_443.4.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	MSBuild.exe, 00000002.00000002.1382796474.000000000430F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.168.117.175	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.22.242.11	a416.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
78.47.63.132	t.p.formaxprime.co.uk	Germany	24940	HETZNER-ASDE	true
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.25	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.44.201.26	unknown	United States	20940	AKAMAI-ASN1EU	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
23.204.152.9	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.164.96.18	unknown	United States	3	MIT-GATEWAYSUS	false
216.58.206.78	plus.l.google.com	United States	15169	GOOGLEUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
13.74.129.1	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
2.22.242.89	a233.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
150.171.27.12	ax-0003.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.43.85.19	unknown	United States	3257	GTT-BACKBONEGTTDE	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1639583
Start date and time:	2025-03-15 23:02:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/291@30/24
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 74 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WerFault.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.78, 142.250.184.238, 74.125.71.84, 4.245.163.56, 142.250.185.238, 142.250.186.78, 172.217.18.3, 84.201.210.23, 142.250.186.74, 142.250.184.202, 142.250.186.170, 172.217.23.106, 172.217.16.138, 216.58.206.42, 142.250.184.234, 172.217.16.202, 172.217.18.106, 142.250.186.42, 142.250.186.106, 216.58.206.74, 172.217.18.10, 216.58.212.170, 142.250.186.138, 142.250.74.202, 13.95.31.18, 172.217.23.110, 40.69.42.241, 13.107.42.16, 142.250.181.238, 13.107.6.158, 13.107.21.239, 204.79.197.239, 51.137.3.145, 88.221.110.195, 88.221.110.179, 2.19.96.128, 2.19.96.83, 2.19.96.120, 2.19.96.129, 40.126.32.133, 40.126.32.74, 40.126.32.136, 20.190.160.20, 20.190.160.130, 20.190.160.14, 40.126.32.72, 20.190.160.128, 2.23.227.215, 2.23.227.208, 20.82.9.214, 2.22.242.121, 23.60.203.209, 13.92.180.205, 2.22.242.122, 2.22.242.227, 40.69.146.102, 2.22.242.82, 142.250.65.163, 142.250.80.99, 142.251.40.99, 142.250.185.163, 94.245.104.56, 150.171.28.11, 13.107.246.60, 23.204.152.8, 13
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, e16604.dscf.akamaiedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, login.live.com, www.gstatic.com, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, prod-agic-we-2.westeurope.cloudapp.azure.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, blobcollector.events.data.trafficmanager.net, edgeassetservice.azureedge.net,
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:04:00	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	ImageG.exe	Get hash	malicious	NovaSentinel	Browse
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://securefilepro.netlify.app/#Amanda_Taylor_Tax_Document_2024.pdf	Get hash	malicious	RHADAMANTHYS	Browse
	Spacey Sun 11.12.411.exe	Get hash	malicious	Vidar	Browse
	BPILEUNC.exe	Get hash	malicious	Unknown	Browse
	PDFizer.exe	Get hash	malicious	Unknown	Browse
	aXeuKjNXAK.ps1	Get hash	malicious	RHADAMANTHYS	Browse
	Dsyhre- approved on Wednesday March 2025.pdf	Get hash	malicious	Gabagool	Browse
	9ua5N7dcBZ.exe	Get hash	malicious	Amadey, RHADAMANTHYS	Browse
52.168.117.175	lNV3432.eml	Get hash	malicious	HTMLPhisher	Browse
	https://innerworks621-my.sharepoint.com/:w:/g/personal/fbayoumi_iwexpress_com/EV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ?rtime=X7A0bhVM3Ug	Get hash	malicious	Unknown	Browse
	https://herbertgschwend-my.sharepoint.com/:u:/g/personal/hg_gschwend-immobilien_de/EXS9Sw4TFC5Inr36Wv80H7EB-SinU6tgDzHWjKCYjfZgDw?e=QtSQPg	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	https://padlet.com/prowebsolutions488/new-message-jba6y6w7rg9tzzmn	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	Message_2530136.eml	Get hash	malicious	Unknown	Browse
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	Unknown	Browse
	Pensacola Country Club.pdf	Get hash	malicious	Unknown	Browse
	https://worldpediatricproject.sharepoint.com/:f:/s/WPPDevelopment/EvAuFq1BT9pLozFuDimSu-ABiw8ZGGyo1rBsk399LO-w5g?e=Qmvjte	Get hash	malicious	Unknown	Browse
2.22.242.11	Blue-Cloner-Signed.exe	Get hash	malicious	RedLine	Browse
	BPILEUNC.exe	Get hash	malicious	Unknown	Browse
	PDFizer.exe	Get hash	malicious	Unknown	Browse
	pid.kvai.exe	Get hash	malicious	Unknown	Browse
	TEDGRQXB.exe	Get hash	malicious	Vidar	Browse
	f1215469392.dll	Get hash	malicious	Unknown	Browse
	Sryxen-Built.exe	Get hash	malicious	Unknown	Browse
	thUKanu6GD.lnk	Get hash	malicious	HTMLPhisher, MalLnk	Browse
	https://www.flipsnack.com/859EECFF8D6/distribution-agreement/full-view.html	Get hash	malicious	HTMLPhisher	Browse
	https://zsharepointonlinems.mysteriousroutes.it.com/kOPeS/#fuck@you.com	Get hash	malicious	Unknown	Browse
78.47.63.132	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse
	ngbtiladkrthgad.exe	Get hash	malicious	Vidar	Browse
	TEDGRQXB.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0002.ax-msedge.net	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	150.171.28.11
	a.bat	Get hash	malicious	XWorm	Browse	150.171.27.11
	https://securefilepro.netlify.app/#Amanda_Taylor_Tax_Document_2024.pdf	Get hash	malicious	RHADAMANTHYS	Browse	150.171.27.11
	Spacey Sun 11.12.411.exe	Get hash	malicious	Vidar	Browse	150.171.27.11
ax-0003.ax-msedge.net	ImageG.exe	Get hash	malicious	NovaSentinel	Browse	150.171.27.12
	DiscordNitrofree2021.exe	Get hash	malicious	Unknown	Browse	150.171.28.12
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	150.171.27.12
	a.bat	Get hash	malicious	XWorm	Browse	150.171.27.12
	AMI BIOS Virus.exe	Get hash	malicious	Babadeda	Browse	150.171.28.12
	load2.exe	Get hash	malicious	Unknown	Browse	150.171.28.12
chrome.cloudflare-dns.com	ImageG.exe	Get hash	malicious	NovaSentinel	Browse	172.64.41.3
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	162.159.61.3
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	a.bat	Get hash	malicious	XWorm	Browse	172.64.41.3
	https://securefilepro.netlify.app/#Amanda_Taylor_Tax_Document_2024.pdf	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	Spacey Sun 11.12.411.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	BPILEUNC.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	PDFizer.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Document25.xlsm	Get hash	malicious	ScreenConnect Tool, AsyncRAT, StormKitty, VenomRAT	Browse	172.64.41.3
	PSAP Toolkit 2.8.0.07 (XML 6.76) Setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
a416.dscd.akamai.net	ImageG.exe	Get hash	malicious	NovaSentinel	Browse	2.22.242.11
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	2.22.242.105
	Blue-Cloner-Signed.exe	Get hash	malicious	RedLine	Browse	2.22.242.105
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	2.22.242.105
	a.bat	Get hash	malicious	XWorm	Browse	2.22.242.105
	Spacey Sun 11.12.411.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	BPILEUNC.exe	Get hash	malicious	Unknown	Browse	2.22.242.11
	PDFizer.exe	Get hash	malicious	Unknown	Browse	2.22.242.11
	Document25.xlsm	Get hash	malicious	ScreenConnect Tool, AsyncRAT, StormKitty, VenomRAT	Browse	2.22.242.105
	pid.kvai.exe	Get hash	malicious	Unknown	Browse	2.22.242.11

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	78.47.63.132
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	78.47.63.132
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	Cm2GRjWK1C.exe	Get hash	malicious	Vidar	Browse	95.217.30.53
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	144.78.165.104
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	RootkitBuilder.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	RootkitBuilder.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	ImageG.exe	Get hash	malicious	NovaSentinel	Browse	104.21.6.223
	ImageG.exe	Get hash	malicious	NovaSentinel	Browse	172.64.41.3
	XClient.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	GalaxySoft.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.112.1
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.181.63
	Install.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS	Browse	104.21.64.1
	ShadowOF-Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
MICROSOFT-CORP-MSN-AS-BLOCKUS	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	204.79.197.203
	Blue-Cloner-Signed.exe	Get hash	malicious	RedLine	Browse	204.79.197.203
	Bthvgkck.exe	Get hash	malicious	Unknown	Browse	204.79.197.203
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	204.79.197.203
	dBKUxeI.exe	Get hash	malicious	AsyncRAT, DarkVision Rat	Browse	204.79.197.203
	MSBuild.exe	Get hash	malicious	Unknown	Browse	13.107.6.156
	#U0437#U0430#U043a#U0430#U0437#U0430_03M4138.docx.doc	Get hash	malicious	Unknown	Browse	13.107.246.60
	#U0437#U0430#U043a#U0430#U0437#U0430_03M4138.docx.doc	Get hash	malicious	Unknown	Browse	13.107.246.60
	Our Order.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	Proof of Payment and Statement.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
AKAMAI-ASN1EU	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	FleshPowerV2.exe	Get hash	malicious	Babadeda	Browse	95.101.148.7
	Gnome app1002.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	kuly.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	mhtyieskfda.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	wjthujawdrg.exe	Get hash	malicious	Unknown	Browse	23.197.127.21
	launcher.exe	Get hash	malicious	Unknown	Browse	23.197.127.21
	mtohpasekfaddd.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	kythkkaewdth.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	LauncherV9.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	launcher.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 78.47.63.132
	launcher.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 78.47.63.132
	work.js	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	149.154.167.99 78.47.63.132
	Bthvgkck.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 78.47.63.132
	v7942.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 78.47.63.132
	dBKUxeI.exe	Get hash	malicious	AsyncRAT, DarkVision Rat	Browse	149.154.167.99 78.47.63.132
	Gocgleo.exe	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	149.154.167.99 78.47.63.132
	Order.js	Get hash	malicious	AgentTesla	Browse	149.154.167.99 78.47.63.132
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.js	Get hash	malicious	AgentTesla	Browse	149.154.167.99 78.47.63.132
	#U0437#U0430#U043a#U0430#U0437#U0430_03M4138.docx.doc	Get hash	malicious	Unknown	Browse	149.154.167.99 78.47.63.132

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_94a9958376cb9b9d82c2fdf0596f2ab52c2584_a6fb66b6_32cab553-2fd8-4028-9fae-40f8edef13dc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0265454944295824
Encrypted:	false
SSDEEP:	192:36YcOWB065xpP+ju0m1zuiFoZ24IO8qK:q4WC65xpP+jqzuiFoY4IO8q
MD5:	8DFD044D0E59A5E631328B48D53D9DAC
SHA1:	FB141FAA265F9E31F34DD4DEC3FB47D38E1D859D
SHA-256:	CB212F5A473AC951A83205C58940864F205F11EADA48F8AC4F34C6B081F18DC6
SHA-512:	5F7E8A128EA137D8588D1D134DC497649A23F79C1F24523B563ADB52B6A705F133F2348D53F09CF33923DE3F1BCB298C936DAA9B9AD2C2A487F36E6E7A4B502A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.6.5.4.9.8.3.6.8.4.9.5.1.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.6.5.4.9.8.3.8.1.1.8.2.8.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.c.a.b.5.5.3.-.2.f.d.8.-.4.0.2.8.-.9.f.a.e.-.4.0.f.8.e.d.e.f.1.3.d.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.0.9.c.f.3.2.-.d.b.1.1.-.4.f.6.2.-.8.4.4.5.-.a.a.7.2.5.c.1.a.e.b.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.3.4.-.0.0.0.1.-.0.0.1.8.-.f.7.d.a.-.5.1.0.7.f.6.9.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B32.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Mar 15 22:03:57 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	164894
Entropy (8bit):	1.8343405331731513
Encrypted:	false
SSDEEP:	768:Qtr2z18d5lHbUccGCEx1IFMLaV1DcOKG+eFH8wscSQ:c6wnbUcNx1IAaV1DcOKG+eFH8wscSQ
MD5:	8FD3EE1FF62F03D3B3D94D74DBDBA763
SHA1:	58EEA5B1057CF5A5FDBC049669C37D6064D5CEAD
SHA-256:	DDB40D7280BA1936312C54702778563E3F3E964BF999A85E3E900E77BA6DEF28
SHA-512:	A7095518362A115CD5DD4007EE19D4C6AD078CB0B76D7F8636FE6848E43DE8A85B309014B49627D6DF1FF45D9C510D4B57F2C00D0CFD56A90D3049F8575A8D7B
Malicious:	false
Preview:	MDMP..a..... .......M..g.........................................J..........T.......8...........T............j..V............"...........$..............................................................................eJ......0%......GenuineIntel............T.......4......g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DC3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6360
Entropy (8bit):	3.7279143616012225
Encrypted:	false
SSDEEP:	192:R6l7wVeJsQ6GYuJIpOHprH89b5ysf5vTm:R6lXJj6GYuJIr5xfo
MD5:	3A61CE372C9422D66CA4BA51280B971A
SHA1:	A5D2EA3DD9F84B218CB8D95D4DCBEFB93C49D533
SHA-256:	8361DFD6DC19A5FCB9793E392DCE5F6509955B5A91C27ACD9DBD7B5C6B4DBABD
SHA-512:	7B2FB97ED8C3507A50F1DEFE76DF3E11453EE1DA7BF08919E08DF901C45E7CA5EE4972B72154DEC30176C0D95E3B9E32DD07820BC33C630108FA4374B5961CB2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E9F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.512772802519157
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9x2WpW8VY6DYm8M4Jaf4FWi+q8XGipsmL8d:uIjfeI7bX7VtWJSiqCmL8d
MD5:	2F81DF7CC2B336A2BE7CC35DE6EA8D7B
SHA1:	E1140E57DFD9AAA8BCCA65D1E62830B797C265A1
SHA-256:	28385CE5E4F9FAA2362EFECF217B019F4B06FBBC4ECC9C344CBBE5173576CAA5
SHA-512:	D4C89EFAF8858C8720CD6651BE125897418503E9C11A43F92425692FB645F31F9B2C2FFAD54CE98E33FE406096455E49454B3F852645E0E2136BD4F727804613
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="762546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\w47qq\c2vsr1

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\g4op8g

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, file counter 2, database pages 41, 1st free page 29, free pages 1, cookie 0x25, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	0.45909911068154247
Encrypted:	false
SSDEEP:	96:OpdTxQ+ALqL/uejzH+bF+UIYysX0lj/twfLyl0e9S8E:OpdT7IqL/tH+bF+UI3i67Kylj9
MD5:	89783266A93C429FCFB9CE049053FCCD
SHA1:	AC70D1404CB8588DBB685165154CA6FD01942CCE
SHA-256:	AF2420C3F982037DA346ACB0722E54A466547DCCFC54C44EA84FBC1401DC15BC
SHA-512:	BD3C480D62EDF9CA8F23BB17E39405E9EE2EE705EEE832F738D4C3AE5C16E3317A1822C07373CB49A8E704B3DA3D7BDC95544208C1C369322E7F8CE2E2DE93CF
Malicious:	false
Preview:	SQLite format 3......@ .......)...........%......................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\glf379z5p

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\h4euai

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 4, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.1353454741604
Encrypted:	false
SSDEEP:	192:elsfoVZkNi61n1ulH5mpX67oVuZVPqfPk:elsfoQx1n1ulH5umoVuZVPqfM
MD5:	D2A4025F32C5C6B3F294F7ECC10DD371
SHA1:	9EFC8B64F96F1D36D8C8AA14286B2FC8E0557C47
SHA-256:	D954F165A5E9B85DED33C1727606EA1A3209FA7E724493B4F64053E171DB414F
SHA-512:	5774023D161B6EB6495361A302F16681144FD12FBC3DE09DB6826EEAB28E2DC0FF36B966FB6BF064A6F7FF3DBA77E0148208FF3D4BA44297ADAAD8B656106296
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\kno8yc26x

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\l6890z

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08441928760034874
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:51zkVmvQhyn+Zoz67V
MD5:	2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D
SHA1:	14DFBE9B28D033542357D98005239D842A16FCFD
SHA-256:	91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
SHA-512:	DD4BD1407DFDC90BC97F5940A120CCDE7D4A6DAA3E0DB1649BED96EBE52FFDF879E52E028657F954FF39A93EEE8F57694A7EAC55D85CA57AF2BBD7A7793B9030
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\n7glxt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\w47qq\t0hlny

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\w47qq\wlfk6f

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215401507481708
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:qq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	4B7413BC9D2D60F801777DE457B19F3D
SHA1:	708BBAC7E9CF6448CBA5AD64C0F7DCF4DFF3355F
SHA-256:	DB9A12C7F30F936B06EEED870E949CF9C2B67EEC18EEFAA62658CE1A8DA8FE19
SHA-512:	71F7472F7918F59BB17F82C6A4B784D6742E7E2683DE4C5D60186664A5E304A21EEF4F8C88E7FC852B207876EC9D3EE963F4805C329FD07F8A4B93A0E3C43021
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1acf7aea-b49e-40f6-81c8-5cce0f0bb2fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	56047
Entropy (8bit):	6.103191670066902
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn2PGWv/sxtww7VLyMV/YoskFoQ:z/0+zI7ynCv/4KiVeZoskx
MD5:	74171FFE2B7FD82BC1B222951FF431C6
SHA1:	733B6A349E065FED9BF4163EC857DD18DCB6AA3E
SHA-256:	AF1DCB656601C9E8A1CD080F6D7DEC1F66571559B49C2DB2778C23E5B5724D2A
SHA-512:	A42F2B4008D984C050C2434ABC7AE54B31AE933744F157ADC743740C552C058F28AE55B9E095F705A935FFDAF9873FD6ADA1A42EEED1ECF03D29EB824084D1BB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\28c84ebe-8411-4580-b386-4dc674a42436.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56051
Entropy (8bit):	6.103052702193295
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn/PGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7yn/v/4KyVeZoskx
MD5:	4CE9879AF6F6C457CA8164690FC7655B
SHA1:	50E3570EAB14726A4880F4363B08486C1E747110
SHA-256:	8BACC7C330C79B4DBB8B1CE50184405A3C2322566ABAF8096A74F854E9F09548
SHA-512:	2B15CC554521BF684A5CF779EEF6A6095E940CA577E1DEFC3718690729715F9A21EF07CF87588B70F1093BC04485D5B3F4080AD0452FA0735081F268E8867BD2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3ccc10ef-35da-40c5-9bb7-8633eba6dd8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57306
Entropy (8bit):	6.100309322910922
Encrypted:	false
SSDEEP:	1536:PMk16zRRSDaIHPGWv/sxtwFShxFoi7VLyMV/YosV:PMYOinv/4KFm33VeZosV
MD5:	E5F200626BDD847C257D73BD8D4744E4
SHA1:	394BF990EE0680A0F5FDD2D17FA9598B04990EAE
SHA-256:	271250E6E04F799892A8851DCB0E921CDF289462D2D3F0A581D7BD0B3BC5C910
SHA-512:	5C634F085D3A578D77C02DDB6DB9DE7BDE2940FE05FF90F04207933013AAB06FAA1734899A1DEA8B0DFBCB4677011D0174B5E5473B0B7DF314F778D2CCE72D09
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"55eb1fe0-d1e7-490b-bc41-6a9ebb143e5f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4aa8e045-118d-4529-ba6e-981a1c8a4e93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57229
Entropy (8bit):	6.100197223441842
Encrypted:	false
SSDEEP:	1536:PMk16zRRSVaoPGWv/sxtwFShxFoi7VLyMV/YosV:PMYOGRv/4KFm33VeZosV
MD5:	130FA39ED6D81450FBE1A9D938D5B408
SHA1:	0738D7CCFDC5BED5F3E53A4FC1294677D70D4C42
SHA-256:	E7CACDB6B38DC0A8E914607DDA223E9DDBFDD8BACBA2078FFC66C79C1A2150D9
SHA-512:	88E95284A5710E6EB11904D6431B224CDE71E3D8AC2CDE87F20A8261D17A90031A9B68A698D0ED18C96157EDCEB694D8D6B2E8DB46B5FF5CA37726796822B7A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"55eb1fe0-d1e7-490b-bc41-6a9ebb143e5f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\582ad12b-5451-48f6-8b58-70a0c3ab7e87.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56125
Entropy (8bit):	6.103388284159357
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yODPGWv/sxtwA7VLyMV/YoskFoQ:z/0+zI7yO7v/4KSVeZoskx
MD5:	9477FA929973B0A833456C2152BD168E
SHA1:	91FC1CD1DAA81AF0AF04EE6F7736CD7E99FDE80D
SHA-256:	C7E9522916B10F7CF483D3C8F08E5C37D5AC12C76EBCDADC73C44B31E96618B6
SHA-512:	20628E833B6F064ABCE2E6B17BCF9C5A11D8D4A53131362E8330CB2076F0303B247FF769B6D008DCE200CDC40F26EE012697DE872C19C764C407FB80ABCE01A9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\719a1c7b-dac3-4756-b1fd-adb99fd0b864.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73e26be8-d52c-4565-9382-f45fe7e28cbf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7f4f9fdf-a2ec-4c24-ba49-4bfdfe78ab4b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	56051
Entropy (8bit):	6.103052702193295
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn/PGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7yn/v/4KyVeZoskx
MD5:	4CE9879AF6F6C457CA8164690FC7655B
SHA1:	50E3570EAB14726A4880F4363B08486C1E747110
SHA-256:	8BACC7C330C79B4DBB8B1CE50184405A3C2322566ABAF8096A74F854E9F09548
SHA-512:	2B15CC554521BF684A5CF779EEF6A6095E940CA577E1DEFC3718690729715F9A21EF07CF87588B70F1093BC04485D5B3F4080AD0452FA0735081F268E8867BD2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\866b686f-7ae7-4c5e-afda-47d0f60ea8ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57306
Entropy (8bit):	6.1002885968431215
Encrypted:	false
SSDEEP:	1536:PMk16zRRSDaAPGWv/sxtwFShxFoi7VLyMV/YosV:PMYOiVv/4KFm33VeZosV
MD5:	D0DC819E0E00D4BDDA94184EED285E3D
SHA1:	9FB809980BC9DF524AE4DA92DF816E9EE9C7E6F1
SHA-256:	D278136247817B21FB810E058E270D0B07A706D3D0637B3BD077D3674BA1C667
SHA-512:	5CA78DB3CD8C7578EAEEE69E110D1E1AEA77BAF16A58E06B0382BDCCC68A8E62AAD20B8E2BE6612CFB8C2D4B32D2F9D476350DF2AAE61D7872132E5195A887C7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"55eb1fe0-d1e7-490b-bc41-6a9ebb143e5f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\33a9fb77-deac-4ce6-a30d-4fff9aae0822.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152186923991
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
MD5:	B1F9E6BC13D304E2CD6F2CB034DAAA14
SHA1:	B77B9A253300DFDAD344E75A7CFC3F4152E78BDB
SHA-256:	EF40EB68E01E88EA3D54D7C3BDF4FAF88620BED39270FBAFFA966F9EA3A6FA2E
SHA-512:	249599DF660E416859BF1387A32DE70B03ACFDC4CD9223269CC9E5B96FA5F10C3A6B6F2432C2857D76163E7CE3EA3FE14211D526D97D6D9316F191F1DC304DFE
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152186923991
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
MD5:	B1F9E6BC13D304E2CD6F2CB034DAAA14
SHA1:	B77B9A253300DFDAD344E75A7CFC3F4152E78BDB
SHA-256:	EF40EB68E01E88EA3D54D7C3BDF4FAF88620BED39270FBAFFA966F9EA3A6FA2E
SHA-512:	249599DF660E416859BF1387A32DE70B03ACFDC4CD9223269CC9E5B96FA5F10C3A6B6F2432C2857D76163E7CE3EA3FE14211D526D97D6D9316F191F1DC304DFE
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67D5F933-1EC8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04636996113971024
Encrypted:	false
SSDEEP:	192:Ki508YiNtminOAUzYYJPi6VBKP72qtX3egvIjhFcNEVoI2vTRQczi3uTn8y08Tcp:J50Mt5MIR2heh1y3008T2RGOD
MD5:	9341C470B50B2B02E9ED41E4A1DED415
SHA1:	87C2A4BA05ECCAF90AFFE2EC277D603B98AA4546
SHA-256:	B32A92F697AC7229FF013FBA4803ECA6A795F77A6BA582A14623A1C0A608E259
SHA-512:	BFBF25E3E26816B56AF48221DBF32B7F80A98DE263CED51684684234C07ADC043BBCF07851BFBBD5039003734934EDF269F28F1F546BEBF122C28F0EEDAEEF94
Malicious:	false
Preview:	...@..@...@.....C.].....@................f...V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".rtqpdy20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.........5..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67D5F934-1FAC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046196075523405024
Encrypted:	false
SSDEEP:	192:HlU08YiNtminOAUDYVJPi6VBKP72qtX3egvIjhFcNEV8IOvGTQsCGikin8y08Tcp:FU0Mt5JIR2hetEOGS08T2RGOD
MD5:	C4D8FBF698595F0C3072F7DB12BF8DF7
SHA1:	F6FB42E589973A540DF9706BD418BE68B95722EB
SHA-256:	67F8E7C3B3A8D59A7D83CCBDC13B27AF77CBDC6BDFAFBF0166B2DC798856D0BF
SHA-512:	E6AAB4872B20DD29704EAFAA36423B5B01C0A582B4771BDF7C8243ADF47962BE732D614C6A00CF3FA0325DD915AC90F6993739D401B566F1C836BB8BD2D1252F
Malicious:	false
Preview:	...@..@...@.....C.].....@................g...W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".rtqpdy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67D5F93E-10F4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04517350377743833
Encrypted:	false
SSDEEP:	192:CVN08YiNtminOAU6YOJWpjrZXpAgiTwh87jNELI8dGRQ8R/4fwn8y08Tcm2RGOdB:aN0Mt5jqNHh24uR4408T2RGOD
MD5:	A98674DDEF2CD66A588C47829DA5D5BD
SHA1:	415D20D8185F530312530EDE19B108E58E4A3E46
SHA-256:	2174A21FCF916C93D6CDFA072E5330F7647640D8F81EB37E0099FDACB8587437
SHA-512:	393BED32BBC843250F572D73FA8E4DEBCACCE7E7B62DB4AB70239C2A714EA2C0D252AC94EF3E85EB37EFB9CC59F120ADE9618E43F63D51B069DDC2C9E8695100
Malicious:	false
Preview:	...@..@...@.....C.].....@................f...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".rtqpdy20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......y...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67D5F93E-165C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4482389958257851
Encrypted:	false
SSDEEP:	3072:GDuuhkGYsj00WN10FGGrPkcJRc2ET2ut3Ts2q7iy8X/4yMg1HFc:zuhfdFGGjkcJ9Eb9nq7iy8X/4yMaHa
MD5:	B0B155FA7C654AE69332F87F89F75479
SHA1:	90038AAE88CD2DF62BD5888EB98467D574A5ADD3
SHA-256:	641DAE19A073BA0067033D2355D87BA15F899A9C03DF7626702CF82E9F1EBCB4
SHA-512:	4247D2517155A69B0B1246C4110E7FB2CD7C7A27CF09766BA38CF6C720F4A892424073EC752693F9CA8B3776F60F6684FD005D3E71993AF33347E70F7B64CA6C
Malicious:	false
Preview:	...@..@...@.....C.].....@..................8...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".rtqpdy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1580339579250625
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUnDll:o1rPWVjWZq3RvtNlwBVsJDL7b/3U5
MD5:	BCCACCAF95B882A8274EC13535756E6C
SHA1:	B11FD3E2176C55159E47DCD95AD9F6DD27CF93AB
SHA-256:	482AFF6538CF7CA449C05EC5C407E74C76116E07D6593154865A10936E24F102
SHA-512:	08CAE3264C01216FC9AF9B43B4D70D2240676C7607676D4EC9CAEB239CF207BF512F3199C8DE8242B059BF500C953F99ABC0D26A9BEB6F7BDB734D01D49E9D1B
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1be0ede2-fa3f-40a5-9dc3-adb0088f6978.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561200349711888
Encrypted:	false
SSDEEP:	768:Y+vrCV7pLGLxw2WPxFfK+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEhetRHirw6eaKA:Y+vrCjcxw2WPxFfK+u1ja1hefHH6eaH9
MD5:	CD255918DC8A13987F9A53E3BEC831B9
SHA1:	F6D568D795CF95B6B7B1E366EAF1F037E266A53C
SHA-256:	19AE862E19A1A696884BA9EC992E383499763922E0E0E91BB91A69C6631130D0
SHA-512:	06B5A95670E1116882BD8F9B4F18C63F3E1B49C0C9FEEAAE0EB7F9907D1F09DAE128E7FA822E462CE91393CA9F9E55A5DADD7F9EF971B5B1C03FD956B3A7556F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13386549823032253","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13386549823032253","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2450143e-36df-4a4a-95ba-acc9fa68a8a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\36e72097-5ec5-4a2b-9cb3-adae3d67860e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7576e552-90b5-48a7-ae2d-512bd05e9047.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564224485265588
Encrypted:	false
SSDEEP:	768:Y+vrd2WPxFfZ+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEhetRHirw6e/KqKpvtu5:Y+vrd2WPxFfZ+u1ja1hefHH6e/HOtC
MD5:	454AD07F4B4FDF1A9D2604E38F4C91C4
SHA1:	1587A02ACCD2C1A499312B4C0ECEF46B9A768682
SHA-256:	CF9C1CBBAEBFA6FBA8651E339D39217F694AD5D97C609AE9A3E574E093C8ADD0
SHA-512:	5D882AA8992681AF8E3BAE4B770744CA828C99F6C0FDF046BFB6A977AD8D2B16EBA59D0F8FC0003748D9D9C38990C3F3B1B58AA180F3B0D7324ECE1D894963D2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13386549823032253","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13386549823032253","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7f0a2abb-8e19-44cd-afe2-31223484c8cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13610
Entropy (8bit):	5.219850430579269
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP9kTysYcZ8+bV+FAQQwVnm8PjrYJ:stmPGKSu4dslxtJZEbGHQw80A
MD5:	A6C08E2C603D733E75F217E3B9FF9007
SHA1:	C604C8C87B6CC1B35219AC119652373746B922ED
SHA-256:	ECA4D23F3F2D518CAEDE0EEE8FE840AED45E730364F245C90BC8DA73AD4DA9AC
SHA-512:	2EB19085F28873B99B2112CAD1BA7F2B02F8AF0D549D0E8CE7E641C278EBB97F1B785BC0C1AC428589C598398C43AA7E6C6F3D76CB25786EB9A00EA39F550CE0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ef69f93-43f7-4732-970c-2b8deb2382a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14203
Entropy (8bit):	5.289298531741684
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP1xvfpkTysYcZ8+bV+FAQQwVnm8PjrYJ:stmPGKSu4dslxtJ1PEbGHQw80A
MD5:	509BE0893ACA178FE6BFB99A517436CC
SHA1:	960CA7E1D9A3A097FE1371B92120B3C72808B496
SHA-256:	E4F884B97DF4023642868B2068CD91E93267A0160817E6AC3CF9D554765303A1
SHA-512:	C48099EFD2AF49E2B5880BAA5843FEBD501434586D77706AC444B6F46CDD02215CA93233B9B9D5213C5F7362B571FD2E7067ED22C79FAB05C2A5FD75DCD326E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\93f690b7-2954-4611-aa13-88c97e1e5038.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14368
Entropy (8bit):	5.287037824100999
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP1xvfpkTysYcZ8+bV+FAQQwVTt8PjrYJ:stmPGKSu4dslxtJ1PEbGHQwNt0A
MD5:	676E1EAF895F1D3F6CE95492AD2DE111
SHA1:	146AC188E45AB91758120718426D302134E03936
SHA-256:	1F2D2D7679FFE6258DD43035E353B83BA236EB21390AAB7B5B18CAFF260034D4
SHA-512:	6BA409DD7198B7C247A980D5E38F8B36F8809E9E50157DC6ACE673460F48227D8806410A4057AFF11FDD1FCFFB34B5CC42687A925F73E06170E8E52C8EBB93FD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9f26e436-cab7-4aca-8a58-c21ee695a2c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14368
Entropy (8bit):	5.286980538421504
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP1xvfpkTysYcZ8+bV+FAQQwVDt8PjrYJ:stmPGKSu4dslxtJ1PEbGHQwpt0A
MD5:	51AA1534B19710E11258B054B30F5544
SHA1:	7E5F01933AF6F2FA56F6968F044FE151C9963916
SHA-256:	D6342A190F5E28E337B581FD27DF51F19836162E25868C8A9BB97D289E4F8E1E
SHA-512:	7355D667FC7BB0F9C091A54DC4F41BC3D1AE949FBE9E0F6AEFF734270B29F86EFF08BC9E386B956216DEA11D3824D2FBCF8D5C29F3F7FC5C63A28A0AA71B3246
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.278131591747728
Encrypted:	false
SSDEEP:	6:iOGdEzT+q1cNwi23oH+Tcwtp3hBtB2KLl4dE/2mAQL+q2PcNwi23oH+Tcwtp3hBH:7GdC9ZYebp3dFLCdOEQyvLZYebp3eFUv
MD5:	0FBBA950D9117785FC5E4F926E6F3D26
SHA1:	88246CECC44C62F4E0FA638512803EB21418B529
SHA-256:	ABFDF35CD536ED4B39C82187203BCC4D2C821D7E547A4D27FE4E7525FE27CEAD
SHA-512:	75AA692157D80615C18DB791E1FF1B522BB3C3D2BE73E955E27C8FDB66797D7115E01D81C55B5AC684AFA46794329EECDC01F8A662B36179FA2C7A7CAB79753D
Malicious:	false
Preview:	2025/03/15-18:03:48.257 4a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/03/15-18:03:48.297 4a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.0406337806828585
Encrypted:	false
SSDEEP:	24576:kBf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kBfgAmmE
MD5:	17B0DDCB82C698A023EB91484ECC3D18
SHA1:	30213A0E1F0B5A4069F7D594D6C55725D3E2BDDF
SHA-256:	10CAADA2694D4D38A4A03A0D1338C6DCC5E051694546D7B3B3168977204A523F
SHA-512:	F99AC75E23009E4A709D0837789AB83D5E300A7D60CAE5528831BA0A9CA20EAEEB3D1DD1BFD134A42788FD5E2DBC1743932025836ADD37E019E87CBFA10EF1F6
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.110639001329295
Encrypted:	false
SSDEEP:	6:iOGdEh+L+q2PcNwi23oH+Tcwt9Eh1tIFUtodELSzKWZmwCdE13FlLVkwOcNwi23A:7GdWi+vLZYeb9Eh16FUtod8SzKW/CdG9
MD5:	041B7D45961D5403703CBBEE7AF27D6B
SHA1:	CF1D9B3DFC66EBB6131D5A71D431CD990658E70B
SHA-256:	A1C91CE69459BEDD35D6B366743C025F7CA98C32623390FF04A7E8AD951E357C
SHA-512:	057CB544AE276729BBF4250BB43AB5891245B4DFA773877D95B7C0D44932C398BB8C0BD0B9A5186089EAA2707E407012E5BAFB2A2314BE41A898B2CC7E2B51DD
Malicious:	false
Preview:	2025/03/15-18:03:48.202 20cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/03/15-18:03:48.208 20cc Recovering log #3.2025/03/15-18:03:48.238 20cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.110639001329295
Encrypted:	false
SSDEEP:	6:iOGdEh+L+q2PcNwi23oH+Tcwt9Eh1tIFUtodELSzKWZmwCdE13FlLVkwOcNwi23A:7GdWi+vLZYeb9Eh16FUtod8SzKW/CdG9
MD5:	041B7D45961D5403703CBBEE7AF27D6B
SHA1:	CF1D9B3DFC66EBB6131D5A71D431CD990658E70B
SHA-256:	A1C91CE69459BEDD35D6B366743C025F7CA98C32623390FF04A7E8AD951E357C
SHA-512:	057CB544AE276729BBF4250BB43AB5891245B4DFA773877D95B7C0D44932C398BB8C0BD0B9A5186089EAA2707E407012E5BAFB2A2314BE41A898B2CC7E2B51DD
Malicious:	false
Preview:	2025/03/15-18:03:48.202 20cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/03/15-18:03:48.208 20cc Recovering log #3.2025/03/15-18:03:48.238 20cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46207599726914833
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuU:TouQq3qh7z3bY2LNW9WMcUvBuU
MD5:	3A2CFF1365F83579309551E03B51EC79
SHA1:	DC48B64C7D6F2883EA66F34B59F69B30ED4B7F8D
SHA-256:	9BF1658BAB917683028DE724CE5618B3C5FCB1FDCCE42013D4A6121A1450573A
SHA-512:	459D95B84FFE1D8EDFFA146B68FC9E4F7843270EED2682D23486CB2AA717F06B44C0115D121FE1A638624E4034CDC43EE702A123288C28765A18534EB5FB4FDB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.195577402693313
Encrypted:	false
SSDEEP:	6:iOGdECAIq2PcNwi23oH+TcwtnG2tMsIFUtodECAZZmwCdE2kwOcNwi23oH+TcwtB:7GdXxvLZYebn9GFUtodXs/Cdb54ZYebB
MD5:	91488E83E1737CE03D25EE2E067F6C87
SHA1:	E4EEDEB9F031E554C2BD70ECBB6F70BD5FF87360
SHA-256:	70B406A15F9AE77A4D299074D18B5CCCFB94BD50051A4A2D2B5E118ACA9F4E13
SHA-512:	E06F49D3CD5B431DE8BA3F37DF48E259E8E8D28742539B53A3AFC6D118C6FF90B636C2AA2B05C4FFD4E6B49EC5B5AD2C03FBDA5FEEE0FF0C84F467C6FB39B5A8
Malicious:	false
Preview:	2025/03/15-18:03:43.070 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/03/15-18:03:43.070 7f0 Recovering log #3.2025/03/15-18:03:43.071 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.195577402693313
Encrypted:	false
SSDEEP:	6:iOGdECAIq2PcNwi23oH+TcwtnG2tMsIFUtodECAZZmwCdE2kwOcNwi23oH+TcwtB:7GdXxvLZYebn9GFUtodXs/Cdb54ZYebB
MD5:	91488E83E1737CE03D25EE2E067F6C87
SHA1:	E4EEDEB9F031E554C2BD70ECBB6F70BD5FF87360
SHA-256:	70B406A15F9AE77A4D299074D18B5CCCFB94BD50051A4A2D2B5E118ACA9F4E13
SHA-512:	E06F49D3CD5B431DE8BA3F37DF48E259E8E8D28742539B53A3AFC6D118C6FF90B636C2AA2B05C4FFD4E6B49EC5B5AD2C03FBDA5FEEE0FF0C84F467C6FB39B5A8
Malicious:	false
Preview:	2025/03/15-18:03:43.070 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/03/15-18:03:43.070 7f0 Recovering log #3.2025/03/15-18:03:43.071 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130477544696663
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW9eqMAqjemp:TLapR+DDNzWjJ0npnyXKUO8+jCpXmL
MD5:	26A36E142667AD12D94F32CCCD4B9A15
SHA1:	16FDDA28E745C9D95741DCBEBB6BD7F0306F35D2
SHA-256:	C20EC3CE6038E8C4B8662BB3894D3AAC2191D9212C600A0420ADE5D6B805C9F5
SHA-512:	704AC42AA26D04C6DD0DF2445F474E3330D9337A1C60C07D3346E72EB310BDE1C6B7870BF7E82C72E3D6EA7B5273DAFB4A1359808DEFC41889CC94E0E461D1D5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354112451771751
Encrypted:	false
SSDEEP:	6144:TA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:TFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	16F52A7CA0A79259F8FC0E2C7D335FE2
SHA1:	09D13EA71CFA415D5FF2369574E14BB0A949C029
SHA-256:	B727EF38DDB29952242467894C20ABD43326C173910B5D8C740E4438A70E6812
SHA-512:	7D2A735FA10CCB35F7EBB4CEE05B06F416D9D47D5E96EF3F3F4B690AE0EFE37D9914E3C7563256B0557A35E00402973806B416F5FBD8CF3AC14D822166613E5F
Malicious:	false
Preview:	...m.................DB_VERSION.11=..q...............&QUERY_TIMESTAMP:domains_config_gz2...13386549829095818..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.153278630969346
Encrypted:	false
SSDEEP:	6:iOGdE19D1cNwi23oH+Tcwtk2WwnvB2KLl4dEilL+q2PcNwi23oH+Tcwtk2WwnvIg:7Gd85ZYebkxwnvFLCd7L+vLZYebkxwnp
MD5:	4BEBF7AB11ED179DF345B021F671AB4F
SHA1:	1A789FB5DCC892EC26726B3ED2E11317C8BEF9A4
SHA-256:	1B0819E2059521BB488FA6CA29C88137EB684DBDA7091041CAD49EF974940AA8
SHA-512:	06C4CD234A4B2D154FFB83AC79056161D0C0784B207301790D3C64F211D74255D1645DDF88C8F33A08035249C923100A0FD1A97AC7EB0F7E6698033A098D6DEA
Malicious:	false
Preview:	2025/03/15-18:03:48.232 20ec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/03/15-18:03:48.321 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324609542649757
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R3:C1gAg1zfvf
MD5:	0AFD719635CEA8B53B9B70132B207103
SHA1:	873EA3502627918EBC666D62164949B1535BD52E
SHA-256:	FDDBDAE2AC8AD9D19F0EC1C1C1330D5556F8EBF9C9169EFA5E1990F258497B3F
SHA-512:	4EA343536F987F5717D984BEF43A90C1E70E3665D009ECF7358A985F25AF5881D21C5E25390696E536F2A4A60EAB7C8050F9E2520793B9918250AE47D4B9A880
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.205758168970007
Encrypted:	false
SSDEEP:	6:iOGdEcwVOq2PcNwi23oH+Tcwt8aPrqIFUtodEFhZmwCdEF7kwOcNwi23oH+Tcwtc:7Gd/vLZYebL3FUtodg/CdI54ZYebQJ
MD5:	F9E89921B3B55F887517C7C5CCD28105
SHA1:	CCFF36C821B75AEDCF7091F90BABC7081D8F8D92
SHA-256:	402CD7424931BBE261250A82CB41177185DA768EB750C3B815A378E713852619
SHA-512:	25A05265D286446ECFF4EC7A4F99B607C6A344A6CB8AE65DDA0B01720464CBFF40D4DD3255DCD576FDCFE58601494130A4FD8BEFFFD980022DD46B2489CD9CA5
Malicious:	false
Preview:	2025/03/15-18:03:43.072 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/03/15-18:03:43.197 7f0 Recovering log #3.2025/03/15-18:03:43.197 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.205758168970007
Encrypted:	false
SSDEEP:	6:iOGdEcwVOq2PcNwi23oH+Tcwt8aPrqIFUtodEFhZmwCdEF7kwOcNwi23oH+Tcwtc:7Gd/vLZYebL3FUtodg/CdI54ZYebQJ
MD5:	F9E89921B3B55F887517C7C5CCD28105
SHA1:	CCFF36C821B75AEDCF7091F90BABC7081D8F8D92
SHA-256:	402CD7424931BBE261250A82CB41177185DA768EB750C3B815A378E713852619
SHA-512:	25A05265D286446ECFF4EC7A4F99B607C6A344A6CB8AE65DDA0B01720464CBFF40D4DD3255DCD576FDCFE58601494130A4FD8BEFFFD980022DD46B2489CD9CA5
Malicious:	false
Preview:	2025/03/15-18:03:43.072 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/03/15-18:03:43.197 7f0 Recovering log #3.2025/03/15-18:03:43.197 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.205223240653183
Encrypted:	false
SSDEEP:	6:iOGdE/Cq2PcNwi23oH+Tcwt865IFUtodEhZmwCdE8kwOcNwi23oH+Tcwt86+ULJ:7GdxvLZYeb/WFUtodu/CdJ54ZYeb/+SJ
MD5:	95858CE5B0D4D1C07C36FD5109757C1E
SHA1:	357CBDAD238B4784F5EB78363AFCFDF5E523906E
SHA-256:	82EAEB74F447DDC6E7C3F42B29B21D0040226F51F259B0D14C3AA9D1135C0187
SHA-512:	072151AD365421E4F2993B20559B0E82E12170CCD9BB3A04C219E0661A7DB57B2670FF53FE441E3760AAFD728C928AD942B37D570E6DD285A41A43958F22AAA2
Malicious:	false
Preview:	2025/03/15-18:03:43.207 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/03/15-18:03:43.216 7f0 Recovering log #3.2025/03/15-18:03:43.217 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.205223240653183
Encrypted:	false
SSDEEP:	6:iOGdE/Cq2PcNwi23oH+Tcwt865IFUtodEhZmwCdE8kwOcNwi23oH+Tcwt86+ULJ:7GdxvLZYeb/WFUtodu/CdJ54ZYeb/+SJ
MD5:	95858CE5B0D4D1C07C36FD5109757C1E
SHA1:	357CBDAD238B4784F5EB78363AFCFDF5E523906E
SHA-256:	82EAEB74F447DDC6E7C3F42B29B21D0040226F51F259B0D14C3AA9D1135C0187
SHA-512:	072151AD365421E4F2993B20559B0E82E12170CCD9BB3A04C219E0661A7DB57B2670FF53FE441E3760AAFD728C928AD942B37D570E6DD285A41A43958F22AAA2
Malicious:	false
Preview:	2025/03/15-18:03:43.207 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/03/15-18:03:43.216 7f0 Recovering log #3.2025/03/15-18:03:43.217 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.14573647022648
Encrypted:	false
SSDEEP:	6:iOGdEXIq2PcNwi23oH+Tcwt8NIFUtodE/sZmwCdE/MkwOcNwi23oH+Tcwt8+eLJ:7GdaIvLZYebpFUtodes/CdeM54ZYebqJ
MD5:	DFAB9D1C8EEF264BDB4BEFE97C252600
SHA1:	3BB0802FE1B6EC045DF6A51BD47422B8FBA45A79
SHA-256:	0D0E7F17F7ED7801DB4714F4C9056C598A622C3F993F49E6BD74307C5FE454CF
SHA-512:	92FF94ED760E368D547C164D83BE6E5EA1DBD25F358399E3FC76CF125F115F3106E03A780AB87578A1B6F12EFD6AD5C2A4AAC51E1F76058C986411CFBC166F93
Malicious:	false
Preview:	2025/03/15-18:03:44.000 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/03/15-18:03:44.001 7f0 Recovering log #3.2025/03/15-18:03:44.001 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.14573647022648
Encrypted:	false
SSDEEP:	6:iOGdEXIq2PcNwi23oH+Tcwt8NIFUtodE/sZmwCdE/MkwOcNwi23oH+Tcwt8+eLJ:7GdaIvLZYebpFUtodes/CdeM54ZYebqJ
MD5:	DFAB9D1C8EEF264BDB4BEFE97C252600
SHA1:	3BB0802FE1B6EC045DF6A51BD47422B8FBA45A79
SHA-256:	0D0E7F17F7ED7801DB4714F4C9056C598A622C3F993F49E6BD74307C5FE454CF
SHA-512:	92FF94ED760E368D547C164D83BE6E5EA1DBD25F358399E3FC76CF125F115F3106E03A780AB87578A1B6F12EFD6AD5C2A4AAC51E1F76058C986411CFBC166F93
Malicious:	false
Preview:	2025/03/15-18:03:44.000 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/03/15-18:03:44.001 7f0 Recovering log #3.2025/03/15-18:03:44.001 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2182474725517195
Encrypted:	false
SSDEEP:	3:ylBntFlljq7A/mhWJFuQ3yy7IOWUU1l+/dweytllrE9SFcTp4AGbNCV9RUIoU:yw75fOl/d0Xi99pEYWU
MD5:	BBB608883634DAA6BCDD0E529EA5718B
SHA1:	27D651BAEF049550648BE52418679A91D41C6A9B
SHA-256:	6200A40821174B236494194A16986169751B731E2A716C0E85AC734F4F786821
SHA-512:	78AC1BE23DF267003143178DECC9C1F98DBB4DA2C47889660FFD6F56283BCD09A7C92114E168D7D5315844176D9B35300358EFA7C86E74586A92B400E656DACD
Malicious:	false
Preview:	............1R.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648080764176686
Encrypted:	false
SSDEEP:	384:aj9P0+QkQerBP/KbtI773pL1gam6Izc8jl+RKToaADhf:adfe2BP/B7iYel+RKc39
MD5:	110BDDE27A5B9EC81631A0A2A9F5CF5C
SHA1:	EE7D3CB097D72D9ACC32C5714CD6507DCDA78070
SHA-256:	D730A60BED221D1F6687D5600BC2DA81540B2E26CBBCBEF5D423F13B3C984AE3
SHA-512:	3B9377CDFAC7F292405546855FD2D622F2A4667D97DE16E7F81795542DD0B6CD6912B247F3D8E3BFA463846FB9B8888D0DF19AFD9D5F08018FD5DFBE5EF3BA7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.298372734670386
Encrypted:	false
SSDEEP:	12:7GdCovLZYeb8rcHEZrELFUtodCK/CdC254ZYeb8rcHEZrEZSJ:7PalYeb8nZrExgpMgoYeb8nZrEZe
MD5:	8314AD962AA457CB8AA3C05E87F093CE
SHA1:	2583F82ACD498F82AAAE299DD83EC0E6F15055E4
SHA-256:	C71C6447FDFDF89BD10A469CC994E29FD48CE82E8CFE219F016FE2D26B7808D5
SHA-512:	3EEBF59C73E333F24A35EF342396AA02286B19705CD8A08C02DBCFFD15EEBE77D2FDC6CE86D723681E6E84E68237BEF8645CA152299D9877F402D82D34A5F1E4
Malicious:	false
Preview:	2025/03/15-18:03:47.951 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/03/15-18:03:47.952 7f0 Recovering log #3.2025/03/15-18:03:47.952 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.298372734670386
Encrypted:	false
SSDEEP:	12:7GdCovLZYeb8rcHEZrELFUtodCK/CdC254ZYeb8rcHEZrEZSJ:7PalYeb8nZrExgpMgoYeb8nZrEZe
MD5:	8314AD962AA457CB8AA3C05E87F093CE
SHA1:	2583F82ACD498F82AAAE299DD83EC0E6F15055E4
SHA-256:	C71C6447FDFDF89BD10A469CC994E29FD48CE82E8CFE219F016FE2D26B7808D5
SHA-512:	3EEBF59C73E333F24A35EF342396AA02286B19705CD8A08C02DBCFFD15EEBE77D2FDC6CE86D723681E6E84E68237BEF8645CA152299D9877F402D82D34A5F1E4
Malicious:	false
Preview:	2025/03/15-18:03:47.951 7f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/03/15-18:03:47.952 7f0 Recovering log #3.2025/03/15-18:03:47.952 7f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	5.578800509166535
Encrypted:	false
SSDEEP:	48:oZhWM/Wvyq8Mkvmtd5d1XZxRV03Sx49RHHS2/48yls9UG:ovV/3yd5dBXBeTQ8os9f
MD5:	1B754888C3820D637C134933AEFCC701
SHA1:	2F4D3B716F3919DE8EE15F99B6E7449C899BB43E
SHA-256:	ED0BDF30AE3D1E1046FBD3788A6516FB09C6740EAC86BC4F0E89FA711B3FB632
SHA-512:	8FCE97174AB3C5A549E9BEC4583B5A453AC281FB2AC6B2B5A98CD1FA491F3DF049B71FC3FCCBA2F2C6E8F6072BD64E810C5E5078BC0625E7C6942716DE637CCC
Malicious:	false
Preview:	N....................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1072}.!_https://ntp.msn.com..LastKnownPV..1742076230590.-_https://ntp.msn.com..LastVisuallyReadyMarker..1742076231898.._https://ntp.msn.com..MUID!.06898F1A137E61ED2A909AAA12D66026.%_https://ntp.msn.com..authRecordTrail...[{"time":"2025-03-15T22:03:50.501Z","action":"NUT","result":"SUCCESS","state":{"isSignedIn":false,"accountType":"UNSUPPORTED_SOVEREIGNTY","signedInAccounts":[0],"storage":{"elt":0,"lt":0,"aace":0,"ace":0,"app_anon":0,"anon":0,"app_wid":0},"appType":"edgeChromium","pageType":"dhp"}}].._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1742076230710,"schedule":[-1,-1,20,9,33,-1,-1],"scheduleFixed":[-1,-1,20,9,33,-1,-1],"simpleSchedule":[15,10,22,33,36,43,37]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.c

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.180559850958445
Encrypted:	false
SSDEEP:	6:iOGdEc+q2PcNwi23oH+Tcwt8a2jMGIFUtodEzqZmwCdEXkVkwOcNwi23oH+Tcwtw:7GdkvLZYeb8EFUtod7/Cd8k54ZYeb8bJ
MD5:	370BBF61E91ED72F96DC1912AC9F3A54
SHA1:	AB949FF41C4E7D23387A90F5005689633D7AB2B4
SHA-256:	ED5B4B38B50B30CD8CD9912C76B41A903D68E5109FFB354374646E17D527EEA1
SHA-512:	5197BF5BD29F4C110BCFE52B864FAE0946AFC3665DF681EC952237935BD993A8603DAED39D7B8FD87F1D8029A9440108EEFFDF22BFA1CAD2DC69311A358860DE
Malicious:	false
Preview:	2025/03/15-18:03:43.531 1438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/03/15-18:03:43.533 1438 Recovering log #3.2025/03/15-18:03:43.566 1438 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.180559850958445
Encrypted:	false
SSDEEP:	6:iOGdEc+q2PcNwi23oH+Tcwt8a2jMGIFUtodEzqZmwCdEXkVkwOcNwi23oH+Tcwtw:7GdkvLZYeb8EFUtod7/Cd8k54ZYeb8bJ
MD5:	370BBF61E91ED72F96DC1912AC9F3A54
SHA1:	AB949FF41C4E7D23387A90F5005689633D7AB2B4
SHA-256:	ED5B4B38B50B30CD8CD9912C76B41A903D68E5109FFB354374646E17D527EEA1
SHA-512:	5197BF5BD29F4C110BCFE52B864FAE0946AFC3665DF681EC952237935BD993A8603DAED39D7B8FD87F1D8029A9440108EEFFDF22BFA1CAD2DC69311A358860DE
Malicious:	false
Preview:	2025/03/15-18:03:43.531 1438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/03/15-18:03:43.533 1438 Recovering log #3.2025/03/15-18:03:43.566 1438 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ae1e609-8b9a-4d19-9613-c46beb6e234f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\53ec8dce-f773-41e1-8b5d-8921ed252e7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1414
Entropy (8bit):	5.271396505358879
Encrypted:	false
SSDEEP:	24:YXsySZVMdBsykZFRudFGcs/Z6ma3yeebsbZC52H8sLcZC52H0cbSpDa7nby:YXs58sffcdshleebsVCgH8sLECgHxbyB
MD5:	E2C0CBD87551E2FADCB05AF94FFBF118
SHA1:	9BE99F9E44EF94AC38A1DA72AA12D7F2F0E53437
SHA-256:	D31EF218554110917079D04A780855940EC3A30C14C87E9FAC3FEB9D042EEF9C
SHA-512:	90AE8AC2588084A35B29CF772B085988C252FFE39B84935CBD226F38E1ED6D01025C812824FF77B0F5C218A64DC898C5A5AA9CD2FFCE07211A5E593C383225CF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389141825406273","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13389141829043791","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13386643431359763","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13386643439501144","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"network_stats":{"srtt":117546},"se

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ed02611-8826-4bb4-bb2d-1a956d8a98f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.779187484691062
Encrypted:	false
SSDEEP:	192:tTZnkA/X9vXIrjkeG5v4sjqmNRJXcf0L/ZJVb:VZnvP9grjklvltNXI0LhJVb
MD5:	19D37730828E915720A85496C032CA22
SHA1:	55FB274CAED4F4B8DEE6F5BDBA364AE6FF04352B
SHA-256:	B92D44E84867208DDC0600980E2B5CEB259B5696CCD00F5918A79C7AE3BC2ED2
SHA-512:	E8B86F267FBC1AF87AE618E25CC8F556E94BCC75C80B9BD5501624FC58997007AEBFFFB769577B79A4B564537715CAB79F1F743BC77E745E3698B4DB2319FB8A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2f63d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.459569234043719
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSDWp:JkIEumQv8m1ccnvSADB2QohfNWwG1a
MD5:	83D284F3CF73129826DCBD2FFA0C13C7
SHA1:	2E5AFC9A1EA5BD877AF1C385D30298A381698370
SHA-256:	B11D8B54AFB75D087D682D12C71FB9103DB4E4D96FEDC7D9A732260AF37C2792
SHA-512:	598E76ED78DB64F05B9B309CBBF607A9F3C5979E180788D983E86081E236442AF78C47032CE5ED82BD42BB1082F930C48E78D05644A3E0FE04829C574BF74774
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF1e942.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF1fa87.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF20006.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a79b6c00-dd98-41ab-a1ae-2c173c02fc5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2c87299-ba21-42e7-bb51-d1c73787d759.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2ff5e8c-f51f-4a1e-bda1-2f118a4d291e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d95489b8-0955-48cb-87a4-6e8086e9b44d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13610
Entropy (8bit):	5.219850430579269
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP9kTysYcZ8+bV+FAQQwVnm8PjrYJ:stmPGKSu4dslxtJZEbGHQw80A
MD5:	A6C08E2C603D733E75F217E3B9FF9007
SHA1:	C604C8C87B6CC1B35219AC119652373746B922ED
SHA-256:	ECA4D23F3F2D518CAEDE0EEE8FE840AED45E730364F245C90BC8DA73AD4DA9AC
SHA-512:	2EB19085F28873B99B2112CAD1BA7F2B02F8AF0D549D0E8CE7E641C278EBB97F1B785BC0C1AC428589C598398C43AA7E6C6F3D76CB25786EB9A00EA39F550CE0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF22541.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13610
Entropy (8bit):	5.219850430579269
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP9kTysYcZ8+bV+FAQQwVnm8PjrYJ:stmPGKSu4dslxtJZEbGHQw80A
MD5:	A6C08E2C603D733E75F217E3B9FF9007
SHA1:	C604C8C87B6CC1B35219AC119652373746B922ED
SHA-256:	ECA4D23F3F2D518CAEDE0EEE8FE840AED45E730364F245C90BC8DA73AD4DA9AC
SHA-512:	2EB19085F28873B99B2112CAD1BA7F2B02F8AF0D549D0E8CE7E641C278EBB97F1B785BC0C1AC428589C598398C43AA7E6C6F3D76CB25786EB9A00EA39F550CE0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2711f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13610
Entropy (8bit):	5.219850430579269
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP9kTysYcZ8+bV+FAQQwVnm8PjrYJ:stmPGKSu4dslxtJZEbGHQw80A
MD5:	A6C08E2C603D733E75F217E3B9FF9007
SHA1:	C604C8C87B6CC1B35219AC119652373746B922ED
SHA-256:	ECA4D23F3F2D518CAEDE0EEE8FE840AED45E730364F245C90BC8DA73AD4DA9AC
SHA-512:	2EB19085F28873B99B2112CAD1BA7F2B02F8AF0D549D0E8CE7E641C278EBB97F1B785BC0C1AC428589C598398C43AA7E6C6F3D76CB25786EB9A00EA39F550CE0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e67e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13610
Entropy (8bit):	5.219850430579269
Encrypted:	false
SSDEEP:	192:stmJ99QTryDigabatSuypdslxyaNP9kTysYcZ8+bV+FAQQwVnm8PjrYJ:stmPGKSu4dslxtJZEbGHQw80A
MD5:	A6C08E2C603D733E75F217E3B9FF9007
SHA1:	C604C8C87B6CC1B35219AC119652373746B922ED
SHA-256:	ECA4D23F3F2D518CAEDE0EEE8FE840AED45E730364F245C90BC8DA73AD4DA9AC
SHA-512:	2EB19085F28873B99B2112CAD1BA7F2B02F8AF0D549D0E8CE7E641C278EBB97F1B785BC0C1AC428589C598398C43AA7E6C6F3D76CB25786EB9A00EA39F550CE0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13386549823750507","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564224485265588
Encrypted:	false
SSDEEP:	768:Y+vrd2WPxFfZ+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEhetRHirw6e/KqKpvtu5:Y+vrd2WPxFfZ+u1ja1hefHH6e/HOtC
MD5:	454AD07F4B4FDF1A9D2604E38F4C91C4
SHA1:	1587A02ACCD2C1A499312B4C0ECEF46B9A768682
SHA-256:	CF9C1CBBAEBFA6FBA8651E339D39217F694AD5D97C609AE9A3E574E093C8ADD0
SHA-512:	5D882AA8992681AF8E3BAE4B770744CA828C99F6C0FDF046BFB6A977AD8D2B16EBA59D0F8FC0003748D9D9C38990C3F3B1B58AA180F3B0D7324ECE1D894963D2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13386549823032253","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13386549823032253","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF22706.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564224485265588
Encrypted:	false
SSDEEP:	768:Y+vrd2WPxFfZ+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEhetRHirw6e/KqKpvtu5:Y+vrd2WPxFfZ+u1ja1hefHH6e/HOtC
MD5:	454AD07F4B4FDF1A9D2604E38F4C91C4
SHA1:	1587A02ACCD2C1A499312B4C0ECEF46B9A768682
SHA-256:	CF9C1CBBAEBFA6FBA8651E339D39217F694AD5D97C609AE9A3E574E093C8ADD0
SHA-512:	5D882AA8992681AF8E3BAE4B770744CA828C99F6C0FDF046BFB6A977AD8D2B16EBA59D0F8FC0003748D9D9C38990C3F3B1B58AA180F3B0D7324ECE1D894963D2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13386549823032253","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13386549823032253","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2403
Entropy (8bit):	5.811833749353749
Encrypted:	false
SSDEEP:	24:F2xc5NmKfcncmoCCRORpllg2hES6fhHXldCRORpllg2hlsii0ECRORpllg2hES1Z:F2emtfrd63fxBrdfixrd6yxJrdcxs
MD5:	14D2D3FA9ECC61D3C1C9A529D9FD6F57
SHA1:	11355258E31BE0750E4C9549A01103519D3AA00C
SHA-256:	A276831DD1E4749192A91393C5D2E22B06AEEAEA47116A9BD174ACE64DBC2403
SHA-512:	2E16ACE64352E052DC67EA0E0A6B15538C2F024A1087DE76CFBE07F1112B9DBD1BA8E7AD9699BA529B60005699DE5719EBCFD89E3416B7E59A184C44AFD7E46F
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.20.i;.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableE

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.175485831384197
Encrypted:	false
SSDEEP:	6:iOGdEnULxKQERM1cNwi23oH+TcwtE/a252KLl4dEnULZMq2PcNwi23oH+TcwtE/9:7GdKPRR2ZYeb8xLCdKVvLZYeb8J2FUv
MD5:	2FB4AA585E418A53ECA21D90D1692C17
SHA1:	6BE9DC45271E1086360DEF54C362855DF61B2ED3
SHA-256:	2CD7AEA73F0F17A3D9EDE2DCF104588B1077ED462DDF3E5EF39572EC2EB04B5B
SHA-512:	E6260148E688AE5532B7BFF9671996F6A401374391AB51799BB69A4CBD7C88E0FBFC5F2735CB80C8EA23F2E233A9118210C784BCD99A6E64CE309354AFC2C0FA
Malicious:	false
Preview:	2025/03/15-18:03:51.863 a24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/03/15-18:03:51.878 a24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	116653
Entropy (8bit):	5.5864037932329165
Encrypted:	false
SSDEEP:	3072:g9LCxPXfO111RHeclL/rdWypSoI8jqYyut:c1RtlL/ZW4SoI8jcut
MD5:	458EC578E6522BB5CAA4411E8D5C0A18
SHA1:	73F536B8A02D80085DAB37C61F17BEA2C4DC8E31
SHA-256:	1BC6A90F99FD2E69DC903944FEACB765808553DB457A911D1D598FFF9F97D309
SHA-512:	DD8D12547D547CC7A1B4F6A33C72C66EB554DC3594B26170E0D67DDB9D7D99559E1675F5F45D1374716F3E9A3C9B78771D03DD22E6ADBB0A264AE605A8974297
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{var e={906:()=>{self.performance&&performance.mark("InitStartTime")},894:()=>{"use strict";try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{"use strict";try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{"use strict";try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{"use strict";try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{"use strict";try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{"use strict";try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{"use strict";try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=fu

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	198657
Entropy (8bit):	6.3839027078486
Encrypted:	false
SSDEEP:	3072:mINm/RjJK0Ow8bwZ9etWUL/dn5xTmcP3/HMFzerlrLfu9y3FxeX:AJGbwGtZL/d5xScXHQzerhfhVY
MD5:	3B9B363BC813E200AE1ABA0A6EBC2221
SHA1:	00010660CB8CCC2B4A22ECD58C8E97C502AADECD
SHA-256:	2B306043C32B332D9AF191E6DB3FBF5A238EEC89DD470815F20244CDAC8ABF80
SHA-512:	D84609ADAD4CC9631836E5D076B43970615961A1C7221C0622700DF9FC111F14F2CB1C605EB00F0D091DB41F464BD993FD82C22CD8DF77403AD1FBAD213646FB
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.@v....exports...Rc".Dg....module....Rc.W......define....Rb...~....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...b.f.{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`........A.`............,T.,.`......L`.....,T..`Z....HL` ....DSb.....................q...1.c................I`....Da....,k...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:VYruFX00Xl/lpV/lxEAtllhAUsdn:yrKXjMA89
MD5:	A9E97352D6CEED6556970D6C94FCB892
SHA1:	D9623552A06FDD3B667E7666632B11F379D3C682
SHA-256:	20531834B09AD711E544448F9E17E8280425AAA40530BC87FD14BC2024F5BCE4
SHA-512:	8A0D6728369EC4578BE3135AE971A22F463DF88CB45B4C34D9126A461008FE889E8D4F873DADD659A85E16304190448F00FE6EB6290E7D2CB9C588DB78A980BE
Malicious:	false
Preview:	@...`...oy retne.........................X....,...................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:VYruFX00Xl/lpV/lxEAtllhAUsdn:yrKXjMA89
MD5:	A9E97352D6CEED6556970D6C94FCB892
SHA1:	D9623552A06FDD3B667E7666632B11F379D3C682
SHA-256:	20531834B09AD711E544448F9E17E8280425AAA40530BC87FD14BC2024F5BCE4
SHA-512:	8A0D6728369EC4578BE3135AE971A22F463DF88CB45B4C34D9126A461008FE889E8D4F873DADD659A85E16304190448F00FE6EB6290E7D2CB9C588DB78A980BE
Malicious:	false
Preview:	@...`...oy retne.........................X....,...................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF24a0f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:VYruFX00Xl/lpV/lxEAtllhAUsdn:yrKXjMA89
MD5:	A9E97352D6CEED6556970D6C94FCB892
SHA1:	D9623552A06FDD3B667E7666632B11F379D3C682
SHA-256:	20531834B09AD711E544448F9E17E8280425AAA40530BC87FD14BC2024F5BCE4
SHA-512:	8A0D6728369EC4578BE3135AE971A22F463DF88CB45B4C34D9126A461008FE889E8D4F873DADD659A85E16304190448F00FE6EB6290E7D2CB9C588DB78A980BE
Malicious:	false
Preview:	@...`...oy retne.........................X....,...................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7493
Entropy (8bit):	3.3886215274301015
Encrypted:	false
SSDEEP:	96:J9I61UhyeVu8Qp+b+ViTFiokggT7UekYRK0/gtOMO4up0OEKAoz9:lCwe8p+bKiRiDnMekUK0/gtu92OOoz9
MD5:	6F55C396858859584072BBE8E6AFBC2A
SHA1:	B9CCA461162F42BB262391E84AB9A5250B871512
SHA-256:	C4F58442367F631F56F9A1C6480C3AB95D8667ECB88FAF47A24685A8A553B04D
SHA-512:	5885564CE6F22E94CE113164256188E1364903C638AC668200079ED484BDB5BBD7E302CA9E5C6D31A22DD102F8778BFCB0920138276107ED2B80E834CA646DE0
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............D...b................next-map-id.1.Cnamespace-d0bff00e_0ba3_4ceb_b2fa_067b3f2293fd-https://ntp.msn.com/.0Nt.5.................map-0-shd_sweeper.7{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.p.w.-.b.x.a.p.m.i.g.-.c.,.p.r.g.-.a.d.s.-.b.x.g.-.c.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.b.v.,.1.s.-.w.e.b.e.m.b.e.d.d.i.n.g.s.-.f.b.v.6.,.p.r.g.-.1.s.w.-.s.a.-.c.a.l.f.b.v.,.p.r.g.-.m.s.n.-.b.l.s.b.i.d.m.h.o.,.p.r.g.-.1.s.-.l.c.k.t.h.1.-.t.,.1.s.-.b.w.o.s.c.a.c.h.e.,.1.s.-.c.h.-.t.r.v.l.t.2.,.1.s.-.e.n.t.r.v.l.l.s.,.1.s.-.p.1.-.b.i.n.g.w.i.d.g.e.t.s.,.1.s.-.p.1.-.t.r.v.l.l.s.t.1.,.1.s.-.p.2.-.b.i.n.g.w.i.d.g.e.t.s.,.1.s.-.p.2.-.t.r.v.l.l.s.t.1.,.1.s.-.t.r.v.t.l.s.t.h.m.,.1.s.-.w.p.o.-.l.o.c.k.-.t.r.v.l.2.,.p.r.e.p.r.g.-.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1764389024108635
Encrypted:	false
SSDEEP:	6:iOGdE0IG+q2PcNwi23oH+TcwtrQMxIFUtodETTZmwCdEBrtVkwOcNwi23oH+TcwJ:7GdKvLZYebCFUtodC/CdiT54ZYebtJ
MD5:	1D6E98F846DFD55A6B0688C61FA3E2BF
SHA1:	E611FA65394A0B356891E4F2E30BDC31A34FCA0E
SHA-256:	B9D68FEFE02CB521D91E88C28CDA39D69A8AAC7CF44CAD0D30518E7FD169CB4D
SHA-512:	AB63073D3D420A2AEBF469386B853B7C39737E411D81D40499394CBDD8818ACBED74D54170AAA8BC97D3D390E5640A2ACF2BA878FBE01F44C9D5285A2848A0DC
Malicious:	false
Preview:	2025/03/15-18:03:43.937 1438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/03/15-18:03:43.938 1438 Recovering log #3.2025/03/15-18:03:43.941 1438 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1764389024108635
Encrypted:	false
SSDEEP:	6:iOGdE0IG+q2PcNwi23oH+TcwtrQMxIFUtodETTZmwCdEBrtVkwOcNwi23oH+TcwJ:7GdKvLZYebCFUtodC/CdiT54ZYebtJ
MD5:	1D6E98F846DFD55A6B0688C61FA3E2BF
SHA1:	E611FA65394A0B356891E4F2E30BDC31A34FCA0E
SHA-256:	B9D68FEFE02CB521D91E88C28CDA39D69A8AAC7CF44CAD0D30518E7FD169CB4D
SHA-512:	AB63073D3D420A2AEBF469386B853B7C39737E411D81D40499394CBDD8818ACBED74D54170AAA8BC97D3D390E5640A2ACF2BA878FBE01F44C9D5285A2848A0DC
Malicious:	false
Preview:	2025/03/15-18:03:43.937 1438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/03/15-18:03:43.938 1438 Recovering log #3.2025/03/15-18:03:43.941 1438 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13386549825537769

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7973451398363856
Encrypted:	false
SSDEEP:	24:3WSlpgPpsAF4unxSftLp3X2amEtG1ChqwduKTQKkOAM4q:3ezFC1Lp2FEkChhtcHOpz
MD5:	62AE03963773A6C17750CB8FD4844989
SHA1:	41F66374F697AB7799AD03E800EA54F589756357
SHA-256:	35E375FB7FA3C8A2995AEC0067B21BE1DA5515DC435225D848761C430EB283C4
SHA-512:	3C000E1482F38A70DC14F0D743B30FE7D557AA34C0603A36B8680B954C8671D30ECDABA60343161AA6C8955F29F3760C15815F8613E691E3AF926222A9AAF423
Malicious:	false
Preview:	SNSS.......!^d............!^d......."!^d............!^d........!^d........"^d........"^d.....!.."^d................................!^d."^d.1..,..."^d.$...d0bff00e_0ba3_4ceb_b2fa_067b3f2293fd...!^d........"^d.....l.2........!^d....!^d........................!^d.....................5..0...!^d.&...{DEB4C218-97CF-4F02-8567-F37199C11CBA}.....!^d........!^d........................"^d............"^d.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........ ..h0... ..h0.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.12770160175278
Encrypted:	false
SSDEEP:	6:iOGdEIiVq2PcNwi23oH+Tcwt7Uh2ghZIFUtodEflgZmwCdEflIkwOcNwi23oH+T8:7GdN+vLZYebIhHh2FUtodL/CdB54ZYeQ
MD5:	73784DB268A1B7800E2111611DAD7C38
SHA1:	7178B2590BC1331C07A5FA55697BDC7604A019C9
SHA-256:	D375756B651812FCD04AB60C9296AFD9AA91E11634DB37F791CB634D79EBE975
SHA-512:	30DFC935A811731E302BCD793F9529B313EC7DA3199ADA73BEB80E6EF1396C4A27738290CB17F2671A080C40B3D4AC253B3CDA688750334BA8CAE9A8F0B48450
Malicious:	false
Preview:	2025/03/15-18:03:43.014 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/03/15-18:03:43.180 1d50 Recovering log #3.2025/03/15-18:03:43.180 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.12770160175278
Encrypted:	false
SSDEEP:	6:iOGdEIiVq2PcNwi23oH+Tcwt7Uh2ghZIFUtodEflgZmwCdEflIkwOcNwi23oH+T8:7GdN+vLZYebIhHh2FUtodL/CdB54ZYeQ
MD5:	73784DB268A1B7800E2111611DAD7C38
SHA1:	7178B2590BC1331C07A5FA55697BDC7604A019C9
SHA-256:	D375756B651812FCD04AB60C9296AFD9AA91E11634DB37F791CB634D79EBE975
SHA-512:	30DFC935A811731E302BCD793F9529B313EC7DA3199ADA73BEB80E6EF1396C4A27738290CB17F2671A080C40B3D4AC253B3CDA688750334BA8CAE9A8F0B48450
Malicious:	false
Preview:	2025/03/15-18:03:43.014 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/03/15-18:03:43.180 1d50 Recovering log #3.2025/03/15-18:03:43.180 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.001794259269347922
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZl1ma6/ll:/M/xT02znt
MD5:	C9F41E9776E3871925DC2BDC28EF4C30
SHA1:	F52904A13F48F6F2A6360A560B450468D0A5648B
SHA-256:	B0D2969B879FDDEBB18E5E4878E6EB5D032E2DAC005EB271B526503E197E2089
SHA-512:	17560B643A3A96E0F29548F415AAD717C7B4C261B639615C92CA3D3E1775667F31750CC5BCE3FDF70DCC3B2F179572EB92EAEAF8942BDBA9978F15C543A247AB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.231142913204684
Encrypted:	false
SSDEEP:	12:7Gdm9N+vLZYebvqBQFUtodoW/CdDV54ZYebvqBvJ:7V96lYebvZgloYebvk
MD5:	246F1ABB2D4E233DCF9030FCB9ACE2DA
SHA1:	61B797876FAB3EC9E0C12676CBCD8B35A3BA5149
SHA-256:	9988393AB832A19A1C8A975F4F451E42C62C3F27DE338F281EED10054F1F7B71
SHA-512:	AEBEB3FB44A76448879F0034B216FE5406D6DC5C3F9C49DD8E40002E714B6C534B614DDCA8D8CE190E794F6076F5BB590180D142A38A89215253B0104360E486
Malicious:	false
Preview:	2025/03/15-18:03:43.954 bcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/03/15-18:03:43.955 bcc Recovering log #3.2025/03/15-18:03:43.959 bcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.231142913204684
Encrypted:	false
SSDEEP:	12:7Gdm9N+vLZYebvqBQFUtodoW/CdDV54ZYebvqBvJ:7V96lYebvZgloYebvk
MD5:	246F1ABB2D4E233DCF9030FCB9ACE2DA
SHA1:	61B797876FAB3EC9E0C12676CBCD8B35A3BA5149
SHA-256:	9988393AB832A19A1C8A975F4F451E42C62C3F27DE338F281EED10054F1F7B71
SHA-512:	AEBEB3FB44A76448879F0034B216FE5406D6DC5C3F9C49DD8E40002E714B6C534B614DDCA8D8CE190E794F6076F5BB590180D142A38A89215253B0104360E486
Malicious:	false
Preview:	2025/03/15-18:03:43.954 bcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/03/15-18:03:43.955 bcc Recovering log #3.2025/03/15-18:03:43.959 bcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\069513db-34ca-4106-a107-54c41152639d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\398171a0-22c6-45a0-b029-f101954b4940.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF1fa97.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF20006.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a49a2999-8431-4ad9-bc7c-4a38081a7d4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ab78d70f-b4ad-43f0-98aa-f466a3fa1659.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.2555977190081355
Encrypted:	false
SSDEEP:	12:7GdfOvLZYebvqBZFUtodq5/CdgW54ZYebvqBaJ:7XlYebvyg3nAoYebvL
MD5:	FE85CFA2066949E37C11BCCBC2ABA034
SHA1:	CD0B51D00941C0C8E4A9B02F24CBD77B316A3B68
SHA-256:	AC39158989387902845160E39A23A43B8657D78ACB6F433C5758E93D0979A34B
SHA-512:	31C435FD61366ED90FFB475A76E4A542710046DD478434035185099D587DD78502C6C74ED1265186ED8E8C09DC17E2F4EEA512BD07FE8EF89C94634FA3134547
Malicious:	false
Preview:	2025/03/15-18:04:02.627 1438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/03/15-18:04:02.628 1438 Recovering log #3.2025/03/15-18:04:02.632 1438 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.2555977190081355
Encrypted:	false
SSDEEP:	12:7GdfOvLZYebvqBZFUtodq5/CdgW54ZYebvqBaJ:7XlYebvyg3nAoYebvL
MD5:	FE85CFA2066949E37C11BCCBC2ABA034
SHA1:	CD0B51D00941C0C8E4A9B02F24CBD77B316A3B68
SHA-256:	AC39158989387902845160E39A23A43B8657D78ACB6F433C5758E93D0979A34B
SHA-512:	31C435FD61366ED90FFB475A76E4A542710046DD478434035185099D587DD78502C6C74ED1265186ED8E8C09DC17E2F4EEA512BD07FE8EF89C94634FA3134547
Malicious:	false
Preview:	2025/03/15-18:04:02.627 1438 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/03/15-18:04:02.628 1438 Recovering log #3.2025/03/15-18:04:02.632 1438 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.264429901239815
Encrypted:	false
SSDEEP:	6:iOGdEzq2PcNwi23oH+TcwtpIFUtodE+ZmwCdEykwOcNwi23oH+Tcwta/WLJ:7GdMvLZYebmFUtodx/Cdr54ZYebaUJ
MD5:	0794FC3ABAD4BE6022214CE153CB70ED
SHA1:	5D9A5078A92981E78311C24B2FEAE9ED6B400394
SHA-256:	BED5F696EAE5C0A4187C1B7912BAA46372927B2A3C31909063ADB84F71CDE086
SHA-512:	02976666B34700235716CF2D304A40849A838B1C3F8962332335EAB09E2631EDA977D0D55C86BC4782DD4A37538DD80DE33B97CF101C5DA8CECA7DEEF830A2EC
Malicious:	false
Preview:	2025/03/15-18:03:43.179 6b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/03/15-18:03:43.180 6b0 Recovering log #3.2025/03/15-18:03:43.180 6b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.264429901239815
Encrypted:	false
SSDEEP:	6:iOGdEzq2PcNwi23oH+TcwtpIFUtodE+ZmwCdEykwOcNwi23oH+Tcwta/WLJ:7GdMvLZYebmFUtodx/Cdr54ZYebaUJ
MD5:	0794FC3ABAD4BE6022214CE153CB70ED
SHA1:	5D9A5078A92981E78311C24B2FEAE9ED6B400394
SHA-256:	BED5F696EAE5C0A4187C1B7912BAA46372927B2A3C31909063ADB84F71CDE086
SHA-512:	02976666B34700235716CF2D304A40849A838B1C3F8962332335EAB09E2631EDA977D0D55C86BC4782DD4A37538DD80DE33B97CF101C5DA8CECA7DEEF830A2EC
Malicious:	false
Preview:	2025/03/15-18:03:43.179 6b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/03/15-18:03:43.180 6b0 Recovering log #3.2025/03/15-18:03:43.180 6b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651608906305545
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMKvSAELyKOMq+8HKkjucswRv8p3nVumg:Bq+n0J+9ELyKOMq+8HKkjuczRv89k
MD5:	94C3A3AAB1735EB13017921A73289596
SHA1:	5142B2FD4849994FB0DAC78C32AA5CD619B980E2
SHA-256:	C8F2307F97BF3A6BCC628A08424E69926D6BC3100AFE29F1DE10EA6217E7DCE4
SHA-512:	6AA96436D47E53BACBF0F65F8B0B5708DEF30F0E93BE0EB5A6EB9E8BB6675D318A3C14CEEB0DB4340C7B01AA4206440638A57234B229D39CD114068DD5959258
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4660326171846017
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0LNe:v7doKsKuKZKlZNmu46yjx0LQ
MD5:	0D77BE52BA6C8C89795E9A0FF134BF4E
SHA1:	DCCA65451D0663EE143A18F9D8642BCAA7799B71
SHA-256:	A967025A0C420959CF4717F4759F8A0D23D6F6FB13574C5A5E4A84E9B3906F9A
SHA-512:	8ED282BC7FA6E40AAF60E9685FCA3F9E267414F9A9344F886F5569C8EFDCE9E7DD93AD19906355EFDB816D3D91EA2D49592419645616DCA1DDBFB5112AAA1232
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b915237f-db45-40d7-b6f7-48de29a25a1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10924686004981252
Encrypted:	false
SSDEEP:	12:0DhLpEjVl/PnnnnnnnnnnnnnvoQrEo8VF4D:0DHoPnnnnnnnnnnnnnvBjpD
MD5:	049A0667FA5FAB9601D83C898806D8A2
SHA1:	5995DAE0D475026ADA114B802EADB5CCF21B86EB
SHA-256:	5705B4AB74DA2DAFDFF633BB00C74914422508442B91C0A6A13E753BDA965C32
SHA-512:	784B0123A8C9484D0ECC7E2D394C54D808992F592AAEA11ACB706551276DF1E9CC654EE3468A66D84A3B2C5B6B4FDBDF979951D8BD95F079022D6E0216FEFD32
Malicious:	false
Preview:	..-.............U.......?.jWa.c.3.-......C~..w....-.............U.......?.jWa.c.3.-......C~..w..........Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	350232
Entropy (8bit):	0.9763767816669108
Encrypted:	false
SSDEEP:	384:vQ5HeCs48r3EMdTrPMaTv8M4TuoMdT0jMhTCiMPT0vMSTE8BmM2Ta87JMETDr+8l:6IH/h66V+ilabuR6
MD5:	5AB1C97522D7AC732F8460EB00732A74
SHA1:	D7FC700DC0357C84A63D7BE30EB67BD04E57678D
SHA-256:	4EC4A5112DBE39E356B692DE9C2BEAC616F1F0274C2382122F0EE25F9020D1F0
SHA-512:	1C0EA8C66EB96B64504FA8D90D9BCA43AA8BE1F32F6C47AEF51B97A2492591CD2060AC488BE4C2DC9B246A63FAD9B5FD94871CEC4DE58EF7BCC4D9ECD5FA665C
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.6843086309544386
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuQzBsedhOmd:llc8BOuuuuuuuuuuuuOa8Nd
MD5:	A1898ECEF1DBB8DABEFBEB71A8703F27
SHA1:	E0F2F67D4CC3F45607981B2F9B8BE110572D58A1
SHA-256:	43AF3C3745D443DF4772797E34C304677455149032DEECEBA9583643A8DE16C0
SHA-512:	429933B3242847214942FAC08ECA24CFE0B61861E73C8C88FA11B9768703A4ACC2876C862A51D23C5CB3FF39161DA36A8165C9201C3CDAB4CE191338F1A09327
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=..................o0................39_config..........6.....n ..1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2366820792853535
Encrypted:	false
SSDEEP:	6:iOGdE1g+q2PcNwi23oH+TcwtfrK+IFUtodE10ZmWZmwCdE1dVkwOcNwi23oH+Tcq:7Gd4g+vLZYeb23FUtod4mmW/Cd4dV54n
MD5:	22A787112C33E90C7EE5BB1939D95451
SHA1:	182264673FBBB8959C4B573B42E19D25FC345143
SHA-256:	BD90136B1BF99A025D7E48D211A39817F3387E991A3BDA5D6F88F46E997FAA82
SHA-512:	C6A3399C460C5CBD780F1642FDCF5CC10C6B42676BB0D80AB914E693E5608D2E8B525D98C8E1109D28B640E6599BF3E3223260FE8E7B18892D06C626D6F7ADC3
Malicious:	false
Preview:	2025/03/15-18:03:43.886 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/03/15-18:03:43.888 1d3c Recovering log #3.2025/03/15-18:03:43.889 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2366820792853535
Encrypted:	false
SSDEEP:	6:iOGdE1g+q2PcNwi23oH+TcwtfrK+IFUtodE10ZmWZmwCdE1dVkwOcNwi23oH+Tcq:7Gd4g+vLZYeb23FUtod4mmW/Cd4dV54n
MD5:	22A787112C33E90C7EE5BB1939D95451
SHA1:	182264673FBBB8959C4B573B42E19D25FC345143
SHA-256:	BD90136B1BF99A025D7E48D211A39817F3387E991A3BDA5D6F88F46E997FAA82
SHA-512:	C6A3399C460C5CBD780F1642FDCF5CC10C6B42676BB0D80AB914E693E5608D2E8B525D98C8E1109D28B640E6599BF3E3223260FE8E7B18892D06C626D6F7ADC3
Malicious:	false
Preview:	2025/03/15-18:03:43.886 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/03/15-18:03:43.888 1d3c Recovering log #3.2025/03/15-18:03:43.889 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.235491825530495
Encrypted:	false
SSDEEP:	6:iOGdE7h+q2PcNwi23oH+TcwtfrzAdIFUtodE7kXWZmwCdETRVkwOcNwi23oH+Tc/:7GdE+vLZYeb9FUtodTXW/Cd0V54ZYebS
MD5:	EFEAE8C5CEA3B9544F03D1A010851F90
SHA1:	74A98595E058C569FCD16BEE32445CF23D01B4D2
SHA-256:	DB2ED164897C9202E4B50BDA7B26A5D3545768243895893245726B246DEB8E96
SHA-512:	75E6288E9EB330F3E6814F27EDE4425319C132181F18610B2A7AD3B4E4E683785D7CFB87F5F969C18455C41CCAF6073DFA57B3F170015ADCFC236A45C8BB0ECB
Malicious:	false
Preview:	2025/03/15-18:03:43.865 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/03/15-18:03:43.867 1d3c Recovering log #3.2025/03/15-18:03:43.872 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.235491825530495
Encrypted:	false
SSDEEP:	6:iOGdE7h+q2PcNwi23oH+TcwtfrzAdIFUtodE7kXWZmwCdETRVkwOcNwi23oH+Tc/:7GdE+vLZYeb9FUtodTXW/Cd0V54ZYebS
MD5:	EFEAE8C5CEA3B9544F03D1A010851F90
SHA1:	74A98595E058C569FCD16BEE32445CF23D01B4D2
SHA-256:	DB2ED164897C9202E4B50BDA7B26A5D3545768243895893245726B246DEB8E96
SHA-512:	75E6288E9EB330F3E6814F27EDE4425319C132181F18610B2A7AD3B4E4E683785D7CFB87F5F969C18455C41CCAF6073DFA57B3F170015ADCFC236A45C8BB0ECB
Malicious:	false
Preview:	2025/03/15-18:03:43.865 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/03/15-18:03:43.867 1d3c Recovering log #3.2025/03/15-18:03:43.872 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1ac19.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1aca6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1d3a6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1d443.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1d55c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1fc0e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e67e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30d5f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103079596931198
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwg7VLyMV/YoskFoQ:z/0+zI7ynVv/4KyVeZoskx
MD5:	DC1ED90381523D0062EDE14D2BAD0DA3
SHA1:	23DFF68534CEA403ED3B5A7BC112239DD37963C0
SHA-256:	1F47249390D63D1C9E2BE769D4A2921F0ABB227A157F439FD9C513461818FFB5
SHA-512:	F17FCB81EC82D674CCABD19CCAB686BAD3B1196FBFC6F6F39A9D6B0C8A72149304CB53D9F9D0C3F2A69BB637C6D02592760F9235B9C375DFF9357431D6C225E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2038449
Entropy (8bit):	4.001519428244933
Encrypted:	false
SSDEEP:	49152:TdRho1vMR2DL+ZAOAcZlxVd4mAgORMy5n2P4+kVbMV8q7b2rN8H4LIXpnKBRaC2O:w
MD5:	0B61B2F5475CE0BFE5B3EF5A966A7730
SHA1:	3CA10EC00C2DD692185745768E1CF60B3BAD32C3
SHA-256:	68EE7B039ED107800E04B606EAC8F97C82CC4171752019A4AA7845A5F708790A
SHA-512:	63CFB530A6D952956E9806EBCD27B1957F0BDB8B21A5A9D77331E863B4F409E490817CBF091CD8C431B44215CDA7C5B10624B0CF3E7DF94FF8577A4C80E2EAC8
Malicious:	false
Preview:	.........\| .*.\|....\|. ..\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2038449
Entropy (8bit):	4.001519428244933
Encrypted:	false
SSDEEP:	49152:TdRho1vMR2DL+ZAOAcZlxVd4mAgORMy5n2P4+kVbMV8q7b2rN8H4LIXpnKBRaC2O:w
MD5:	0B61B2F5475CE0BFE5B3EF5A966A7730
SHA1:	3CA10EC00C2DD692185745768E1CF60B3BAD32C3
SHA-256:	68EE7B039ED107800E04B606EAC8F97C82CC4171752019A4AA7845A5F708790A
SHA-512:	63CFB530A6D952956E9806EBCD27B1957F0BDB8B21A5A9D77331E863B4F409E490817CBF091CD8C431B44215CDA7C5B10624B0CF3E7DF94FF8577A4C80E2EAC8
Malicious:	false
Preview:	.........\| .*.\|....\|. ..\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.007184812097338
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAcikwJVY:YWLSGTt1o9LuLgfGBPAzkVj/T8twJVY
MD5:	30603DFFA6A967D1C6F7A8E225ECA306
SHA1:	02931B2C59160850958355CA13A4BFB29C764606
SHA-256:	E4E276032CE580C323A81EADB80610EEF233593F793BF98CB7BC2F9127841432
SHA-512:	722A1B9C1CA7AF305DD6981084475CDEE8AB220A3EDE98C46ABADFBA4DC402F7E00782DAED88D417D7D6FA7E317F4F7EF02EF15861BF25080904376A885E33AA
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1742177026852736}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d9428828-23d7-438c-a530-2971d67c64e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56047
Entropy (8bit):	6.103191670066902
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn2PGWv/sxtww7VLyMV/YoskFoQ:z/0+zI7ynCv/4KiVeZoskx
MD5:	74171FFE2B7FD82BC1B222951FF431C6
SHA1:	733B6A349E065FED9BF4163EC857DD18DCB6AA3E
SHA-256:	AF1DCB656601C9E8A1CD080F6D7DEC1F66571559B49C2DB2778C23E5B5724D2A
SHA-512:	A42F2B4008D984C050C2434ABC7AE54B31AE933744F157ADC743740C552C058F28AE55B9E095F705A935FFDAF9873FD6ADA1A42EEED1ECF03D29EB824084D1BB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8466054627431507
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxTJxl9Il8uYN4uRjhw5/s/bXYbwXyv3cd1rc:mg9YruDO/s/viP7
MD5:	B7B9F18536703FC5FA7158001579EADB
SHA1:	1AE6C40AD749024731704F2151BECB21605CB956
SHA-256:	BA06DA9CEC0852DFF309E04A3810448C8374A939595626902F14227D35C4746A
SHA-512:	BB14CD05E7E814419A080C4014D6294597948C16504CE7A12F4531CA3CE2625E8FD21C4353C38D6A7382F4D7FEB1A8E78F821121F0F301262EF511D108979D09
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.U.8.g.f.6.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.q.O.j.o.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9975668962550475
Encrypted:	false
SSDEEP:	96:fYgS0Bvqj6IcRFMIS12mXUMzu8VV7nEtG70s73jwgS2i:fVuIFjS12mXUUV7nE1s7sgST
MD5:	EBEED6B444F54C79F7D6063BF5872D2F
SHA1:	47F881C5DD4070AD2A0874DB3710DA169DBE745E
SHA-256:	A87FF85F6E3EAB658C108C403CAC88DF1958E650AFA61B5815699C1CCB65FD1A
SHA-512:	748F40606E6CE970C1A92929E75A227F57418300334E7D43001BF85B41858B6D22F1B3194281127FE794B85D7DFC79D28D383351FE3E19992D68ECFDCA7061FA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".x.K.V.r.Z./.a.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.q.O.j.o.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8980432019454114
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xwNuryxl9Il8uL42cA7vus4pcHjt9sCFlU9snBNMCiSmIukid/vc:aiNyWYN4s7Gs0crHssBOCiSrr
MD5:	DA2C7E3AEBCE73E807ECDBF8F3C277BA
SHA1:	190E54AACD2F5EC63480DD57C8CB3AF641520A0B
SHA-256:	34D5B34375BF69F85DB5708F708A0510771566A07611BD811AF685AA6F5CF5C2
SHA-512:	067C5FCC494A34F6DAA133493F8027DA2436C0005D7AD208E7ACC2A0CC0E28B092E5ADC1F67CB615456F8224A0BF5646F11D220F4EE2A696668A71457DE089D1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".M.o.e.A.l.8.e.0.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.q.O.j.o.n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\json[1].json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	5.4036678515194065
Encrypted:	false
SSDEEP:	96:6NnC+HC8NnCUbCnNnCE9CTNnCACdgECxNnCsMcCs/NnCvnDCiNnC8wCdNnCvt3CM:6NXNGNqNzCKN5M+/NqLNtbNu
MD5:	05B935BBB9022C36BD443D4CFC91B84B
SHA1:	CEE7578BFAC1BAB3FD7894CA2646B569F62317E3
SHA-256:	812460FB3E6AD1545C3AEDF6666AFEAC6BA31AE14CFF9968CC91EF953D42287F
SHA-512:	9438C5F6FFE5A943BDA7CFA655BFE51283EB75B8E62A152FAFD3D05210769019A92EB8C620B600E55CD6113A9204356A4AE948D66D0E28A5E5E90A20B4A76962
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/EA3C1E5A4CCBA004A98EF479261FAAD2",.. "id": "EA3C1E5A4CCBA004A98EF479261FAAD2",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/EA3C1E5A4CCBA004A98EF479261FAAD2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/2754F654BF1C7C06A87D6D8C7BFCAF34",.. "id": "2754F654BF1C7C06A87D6D8C7BFCAF34",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/2754F654BF1C7C06A87D6D8C7BFCAF34"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373047271350726
Encrypted:	false
SSDEEP:	48:SfNaoCiKhDh1TECiKhLfNaoCYC+fNaoCMgdCMDfNaoCP8x0UrU0U8CPC:6NnChTEC1NnCYCmNnCMgdCM7NnCP8x0k
MD5:	560D630F464436BA60B7852820CFAFC4
SHA1:	8AD632663A99942BEB817077A6B7BD78FA7A7F18
SHA-256:	EC2C633D02B81F9A7779380ECC90D66BD740CF7B71341DE31AE13EF42AEE5FE9
SHA-512:	29622FCE71C18AABCFBEBFCC7E0E075B05B3173EDE352A8C21440E61191C7F5E62741F7CFB6FBA32EFDA7271B3B113C486E8B397041E31D50AD577B91ED38EA9
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/52B4B05B15DCDFF1DDC2BA26A507D23D",.. "id": "52B4B05B15DCDFF1DDC2BA26A507D23D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/52B4B05B15DCDFF1DDC2BA26A507D23D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/410A7BD2DC082D7F0C179E10A0CEF5EC",.. "id": "410A7BD2DC082D7F0C179E10A0CEF5EC",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/410A7BD2DC082D7F0C179E10A0CEF5EC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\04c3c623-c668-4174-9f0a-07da3657ba18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\4581bab3-27fd-4c25-b636-434a9cca70dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1824276
Entropy (8bit):	7.995069614749688
Encrypted:	true
SSDEEP:	24576:vx7N32JEI7TMVL2JCvDQma1ff2mo7iBSKp5rYt/sLsmOpk/uYYKfy06utA7cf+zL:aEIctRcmah+b7vKp5G/sBBq7mRkwlJQ
MD5:	959A3589A943BB098300DF74BAF51506
SHA1:	DCCC41BA4E4861D39BD52A4BABCE1F733BFC1C68
SHA-256:	B22F0C2E772B3C769762E8564D6A7F0F66720DF3085B1686BB4DFEE0BE6B1DFB
SHA-512:	6F23849EE408874E62C443F5F90D5E1E68E2E48E1EFC20D965743483FF6337C5D3E4686DF5AD009A4022EC2B5BD4F77F51C9B3523491527F0322E828D58F6929
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDAThC].wt\...u.Z.......L..F.1%..;$. \ .$7.M.........y!....bc.E.-K.F..f.Q..e....[g....;k.?F.r.g...._I6.'...M.Kf.Jf8..p&..l..T.......!..T.........j....w?..7.....@.....n..~A..J...c._........A...........,y...#ZH1.Jrv...t..B.B.x3EK'3D.$......\.x6.B&.l:.T.l&O....r\.D sS0.C..!.7n`..3.....w3=7.....Uf:j.tW.....v....C.....v..y..._....1S..dO.....I.OS A...\.H"..B..\.T4K..'.).I.H.R...$2....C"S ....(..P.C6..(..#,.=.......O9x.-.X.e...~..F.......#~........>.....cv-{...[ulu[.j.j...'.?...7........?....P..Y..H..D..Df.$.Sd.9r...L...D.X6G.../. ..O.(d..MCd.N."............N....M.#..Rvh$.0.h..hu.h..4.+9./..TI.U.q..c..C..}V.{Lj.Xt.u.9p..._....E..g..6.}>r.c..,.)dH&.,.GY....d....l.H6O".#...d..9H.af.l8..W......z....u.`b...n......V.MV.>..V..V...ME.MI.]I.C.q........Uf....v#M.=GL:..5l.....zB.....oq.q/.3}......)R.$.h.d4G6......s.<..4.8..8D.....s..~...!m?}......V>.h......T;.x.....f-.F........'.

C:\Users\user\AppData\Local\Temp\5ae5d838-b513-49b2-b435-0b6c47a40642.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\819a0976-7b40-42c2-b8f2-afc603a47fd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9f48a731-363d-473f-b922-899b1d868aa6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\bef99c89-29b3-4834-9177-5f219b5cdc42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154545
Entropy (8bit):	7.839678617100523
Encrypted:	false
SSDEEP:	3072:zZH5WPD5SqCJryow8AWTtwGrasOQNHjWRKnvXTwL:zpIPFCXjAWTtwGusOWmMvjwL
MD5:	EAE462C55EBA847A1A8B58E58976B253
SHA1:	4D7C9D59D6AE64EB852BD60B48C161125C820673
SHA-256:	EBCDA644BCFBD0C9300227BAFDE696E8923DDB004B4EE619D7873E8A12EAE2AD
SHA-512:	494481A98AB6C83B16B4E8D287D85BA66499501545DA45458ACC395DA89955971CF2A14E83C2DA041C79C580714B92B9409AA14017A16D0B80A7FF3D91BAD2A3
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...................h...\|..=.Ih.\...T.....}..u0...HVND......R....~D.H$9w._2.3.2...5.H.V.@....k;..c.V.7s....9o`_3qP{}.....G....5.:.m..]..:.w\|'..lG.../..,...G....g...O..}....K.Hk......T>..F7G.!n..h.j...J...XzbG....kK]!z..;.K.U.......1:..7w.....6...N.I!....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!...j9%2/.....(-.C.....].=....I.a..!......k..,i.....T.m.xM.W4.)`0..6R".%............m..8.....\|.#......`..L0~..F-....B%.Bh.......H....R..~...Z....7Q...y....?.....[......t........J.R^....o....?.%....3h...8.....e..0.v..33.Si...._....3.d.S...Y....b.....O.s$......~...)l..g._.);.S.......yn@.....3iG.).I76.]..].t_..

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.417014138860781
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0MyLw5w7eR0X35M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ57
MD5:	5ED3374F0D7FB40EE78196235D75F67A
SHA1:	ABF772BA136A275D38C40B20C1467652410C4EC0
SHA-256:	98F6BB2821DE8C7C6170A412A7108AB73DD434A8A375BFF9E47F8B4EA08CE674
SHA-512:	87B9BC294D08D3F201CE9E5A0794DC074D53AA5D8B31A2B0E9B3BF7D002625348527FCC48F0784775A10309262826C67E0610243E38038375315C01EB23F15F0
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\ecab9c28-aa9a-4bcd-bab5-d2458b1c726b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_1484013202\9f48a731-363d-473f-b922-899b1d868aa6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5724_1484013202\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5724_1484013202\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5724_1484013202\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5724_1484013202\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.757003753691263
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvlcp7xpHsUy:m8IEI4u8R039y
MD5:	8F99E1EF2AFC5F73D9391C248A0390AA
SHA1:	DD15DCD68FFB7CBA69C6BBA010DF57A75390C64C
SHA-256:	D57215628AF1ECD1ECD8F83DA69245161E4E0A2CE24846B2FFF6B35DA232709B
SHA-512:	8F4AA8CE2EA90958BEC430CD46F1E76D8E7617C0735D8AB896F4DA1F84F3220920CCA6CA2DA2D7559355423EC115342183615F7E62E72EE6168A5930A078948B
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1h9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APhgiVb
MD5:	C1650B58FA1935045570AA3BF642D50D
SHA1:	8ECD9726D379A2B638DC6E0F31B1438BF824D845
SHA-256:	FEA4B4152B884F3BF1675991AED9449B29253D1323CAD1B5523E63BC4932D944
SHA-512:	65217E0EB8613326228F6179333926A68D7DA08BE65C63BD84AEC0B8075194706029583E0B86331E7EEEC4B7167E5BC51BCA4A53CE624CB41CF000C647B74880
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122162
Entropy (8bit):	5.444710692772984
Encrypted:	false
SSDEEP:	1536:mKgC9lwS3skucsAHnA5Ayc/XzyEW8WW9Y1G6WIMctANlKIkk0ToyxecN9Bu1/9a:0UsMXz7b81tANlKr5oyPBuza
MD5:	01984DBFE92DF14DBD118C381A3D48F4
SHA1:	F85DB8A14D3F8A2F66AE153C56D37FAA68EFE8E3
SHA-256:	3A78B6FBC16F9FB27CE3ED650ABC31174263D762B71C028CC5D8F5427CBAB082
SHA-512:	91A575EC15BD3B37254623F5039B3F437A8EDED7761D1FADF8FD0D5B06247589AC055EEFD8F6627C5F6843663A90330E7603E00315D91D8D7B43F6C87D9D2888
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=fa(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (337)
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.678465166211649
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK6ALY6WHXt3:2Q8KVqb2u/Rt3OnjNkdd
MD5:	0396274AAF2EAE8917E5EB52CF69DFA4
SHA1:	96F53CFB2D6980E12AACEDC6D91759E7F5CA1718
SHA-256:	13E1562CD07FC06D692FDF1AA471E3CEAE3CF7C1E42C5345D430A947139A24D5
SHA-512:	091212DD84FCE06E0D47C6E26E0959A660B36B53D7AADE1DAC5CA2795E44B4D81AB271213DAE68E70A04EE2BDE9BCE4A63587580EC06B3FBBB7A2576B62ABD16
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;window._docs_chrome_extension_version="1.89.1";}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4884)
Category:	dropped
Size (bytes):	130889
Entropy (8bit):	5.42886594885059
Encrypted:	false
SSDEEP:	1536:6EO+9lhvoaEAoAf0OliS9XbrrJQiFZcBaw7ILYzEVKOAKa4q32O1I5Z+dOOXW+xi:DoE9Xb9ZevcKOAKaN2O1IwOOJxX9U
MD5:	BC4DBD5B20B1FA15F1F1BC4A428343C9
SHA1:	A1C471D6838B3B72AA75624326FC6F57CA533291
SHA-256:	DFAD2626B0EAB3ED2F1DD73FE0AF014F60F29A91B50315995681CEAAEE5C9EA6
SHA-512:	27CB7BD81ED257594E3C5717D9DC917F96E26E226EFB5995795BB742233991C1CB17D571B1CE4A59B482AF914A8E03DEA9CF2E50B96E4C759419AE1D4D85F60A
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir5724_390175831\bef99c89-29b3-4834-9177-5f219b5cdc42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154545
Entropy (8bit):	7.839678617100523
Encrypted:	false
SSDEEP:	3072:zZH5WPD5SqCJryow8AWTtwGrasOQNHjWRKnvXTwL:zpIPFCXjAWTtwGusOWmMvjwL
MD5:	EAE462C55EBA847A1A8B58E58976B253
SHA1:	4D7C9D59D6AE64EB852BD60B48C161125C820673
SHA-256:	EBCDA644BCFBD0C9300227BAFDE696E8923DDB004B4EE619D7873E8A12EAE2AD
SHA-512:	494481A98AB6C83B16B4E8D287D85BA66499501545DA45458ACC395DA89955971CF2A14E83C2DA041C79C580714B92B9409AA14017A16D0B80A7FF3D91BAD2A3
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...................h...\|..=.Ih.\...T.....}..u0...HVND......R....~D.H$9w._2.3.2...5.H.V.@....k;..c.V.7s....9o`_3qP{}.....G....5.:.m..]..:.w\|'..lG.../..,...G....g...O..}....K.Hk......T>..F7G.!n..h.j...J...XzbG....kK]!z..;.K.U.......1:..7w.....6...N.I!....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!...j9%2/.....(-.C.....].=....I.a..!......k..,i.....T.m.xM.W4.)`0..6R".%............m..8.....\|.#......`..L0~..F-....B%.Bh.......H....R..~...Z....7Q...y....?.....[......t........J.R^....o....?.%....3h...8.....e..0.v..33.Si...._....3.d.S...Y....b.....O.s$......~...)l..g._.);.S.......yn@.....3iG.).I76.]..].t_..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.420542280292721
Encrypted:	false
SSDEEP:	6144:jcifpi6ceLPL9skLmb0m/SWSPtaJG8nAgex285i2MMhA20X4WABlUuNN5+:Yi58/SWIZBk2MM6AFnPo
MD5:	4FD9109AE7E7522A2F7A39C925B29C0D
SHA1:	6D8570D4CA436766F298EA915CCB458F34020BE2
SHA-256:	A4168E29FBF36F1085FA2F32112EAC7E8278C9DE37CF8707FA7C9EC2AC075141
SHA-512:	72E9392F8E2EDCBCF69DA55DC506488ABB1B1DE0B0F3415F83BFD7CE03F34F298E1DD0EEF975A00B7336AABF7A5698F166C092786D1957037CFAEA395D7996C6
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.349865760247148
Encrypted:	false
SSDEEP:	96:mtOTUb1db1ClNY5co7shdiUYVqig7O7aZCUgpgXEt94k+g8IHh8u928DoCLQ:mtOT8TfL1Vqig7mIg8IB8u88DA
MD5:	70A8F21806E7F1B739937970EBE49A0C
SHA1:	6BE9EEBCE438DE91FEB20E6A5458774B327AA9B4
SHA-256:	C8B531CFD6E9BE13762E289820F67406331303CD5111A885DE959BF83DD0F5AC
SHA-512:	3C055567D0ED53BD30773C0BE475DC7499E44AFB92FB05021029D9A0C1299A470CDD3A8CACCCF798D5345ED627C5836E9DF5955A120FE56BA3624EC76A673270
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.sDa5bc0wD58.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTucClwlLUqaQmlTybxGncrc_XS2Pg"
Preview:	.gb_Q{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ka{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_La{fill:#f9ab00}.gb_H .gb_La{fill:#fdd663}.gb_Ma>.gb_La{fill:#d93025}.gb_H .gb_Ma>.gb_La{fill:#f28b82}.gb_Ma>.gb_Na{fill:white}.gb_Na,.gb_H .gb_Ma>.gb_Na{fill:#202124}.gb_Oa{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1437)
Category:	downloaded
Size (bytes):	117390
Entropy (8bit):	5.490758436358278
Encrypted:	false
SSDEEP:	3072:jMyvhJyj1UjPEWKcxUww3wM0W/N79419n5QJEx:jMyfyj1cPPC70W/Na5QJEx
MD5:	B52266FAD5115039E3806FF8DCD71F86
SHA1:	8007278E322C8EA9F3CB5B62008E3E3599E9F659
SHA-256:	E390D05D78F6E51B03F7C3D1D0C3B7C3E79B3D53C4F83685CFAD83D2E863456E
SHA-512:	58293A89F48926A7059F6C91AA79EBD941072D3BC31AA571342ABA76F007981750620F960CCB59E9E3C828FC8E1748B500E3138381D82EF8A171AD7C60F5C5FC
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var aa,ea,la,oa,ya,Ba,Ca;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.la=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.na=la(this);oa=function(a,b){if(b)a:{var c=_.na;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.oa("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	131658
Entropy (8bit):	5.437709046654644
Encrypted:	false
SSDEEP:	3072:M+NkDj4BST/k4ZYSTVcxhN/aZI4RpTh6z6x0zW:jWjLT/k4ZYSTVcxhN/aZI4RpTh46AW
MD5:	70F8B5F50AB3BAC284D7801AFA53487C
SHA1:	603068C26184802F0CE0FFFAEC9215490E8A8109
SHA-256:	00253C25508F5F3E8188AD4BBC4C1C9CEBF3BD3627EC2E94F78781C788CF6A9C
SHA-512:	30DEA468D7BFA127CA3462B64575D8FDF741FCB1B4D4A0D064791D1520403543CDA5999BC8FB62FA8E53BC29283EB98C2B4C3DB7E4658518251BF5ECF7DAA137
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Fa gb_2d gb_Pe gb_rd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Qd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_ld gb_pd gb_Hd gb_md\"\u003e\u003cdiv class\u003d\"gb_xd gb_sd\"\u003e\u003cdiv class\u003d\"gb_Kc gb_R\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Kc gb_Nc gb_R\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	173494
Entropy (8bit):	5.555398746302217
Encrypted:	false
SSDEEP:	3072:wZ7uHDIsNQgotB5eWAkoF8SgF5JBnz5P2eNmAp1ofnDT9mm0GdZINGJDuqFeRyX5:wZ7ujIsNQgotBwWAkoF8S25JBnz5P2eg
MD5:	4B41432CA29BA7B366890C3211D319DD
SHA1:	C60F89E8ACCE6E93A14BE7E09C8A719BAC3AAF46
SHA-256:	9E09A8F1471D9E076C80D0E6D9D4A888E34D63EA93EF10740811E82FA9E1BD94
SHA-512:	BA762DAE90D37D25E8BA33F7FC43A58C6C758D842912288110923F798245A3A1408AFC13AAC7124A8CDE2D3E6D9AB50BDD626D0558421945785139E0EDA15C38
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.eebVy_fNKiM.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv9PWxAWOkNMB0THY2YxYWamdWWtA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Oi=function(a){if(4&a)return 2048&a?2048:4096&a?4096:0};_.Pi=class extends _.P{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Qi,Ti,Ui,Wi,Xi,aj;Qi=function(){return typeof BigInt==="function"};Ti=function(a){const b=a>>>0;_.Ri=b;_.Si=(a-b)/4294967296>>>0};Ui=function(a,b){b=~b;a?a=~a+1:b+=1;return[a,b]};_.Vi=function(a){if(a<0){Ti(-a);const [b,c]=Ui(_.Ri,_.Si);_.Ri=b>>>0;_.Si=c>>>0}else Ti(a)};Wi=function(a){a=String(a);return"0000000".slice(a.length)+a};.Xi=function(a,b){b>>>=0;a>>>=0;if(b<=2097151)var c=""+(4294967296b+a);else Qi()?c=""+(BigInt(b)<<BigInt(32)\|BigInt(a)):(c=(a>>>24\|b<<8)&16777215,b=b>>16&65535,a=(a&16777215)+c6777216+b6710656,c+=b8147497,b*=2,a>=1E7&&(c+=a/1E7>>>0,a%=1E7),c>=1E7&&(b+=c/1E7>>>0,c%=1E7),c=b+Wi(c)+Wi(a));return c};_.Yi=function(a,b){if(b&2147483648)if(Qi())a=""+(BigInt(b\|0)<<BigInt(32)\|BigInt(a>>>0));else{const [c,d]=Ui(a,b);a="-"+Xi(c,d)}else a=Xi(a,b);return a};._.Zi

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (872)
Category:	downloaded
Size (bytes):	877
Entropy (8bit):	5.178222761159615
Encrypted:	false
SSDEEP:	24:L3cYLdyKSBHslgT1d1uawBATJuoBN2t2t2t2t2t2t2tomffffffo:LpyKSKlgJXwBAtuSNYYYYYYYomfffffA
MD5:	62BABFF1810529A2356E6AA9B78A5D7C
SHA1:	8799F29CA3C96EFA136E384B02A712BCAD987689
SHA-256:	E6FE437E5331732D1D31FBB326918D4C559B39907BA92A0292462838143858AE
SHA-512:	705360C64C45AA29EEE8D3B5BBC3450867AAC2D099646FE537BBD05BFD00F638F2E74DD25A6C89AECA4EDCD38BA67AB9D572FFB08ED77AF6B64550F4E0912E3A
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
Preview:	)]}'.["",["dynamax raikou counters","coffee creamer recalled","tennessee baseball florida","antarctica map","monster hunter wilds crashing on startup","nyt connections hints march 15","florence italy flooding","ufc fight night predictions"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2VhcmNoZXMoCg\u003d\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"-7457314255407826712","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.263876158617635
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	370'688 bytes
MD5:	38da35e91c9aeea07d77b7df32e30591
SHA1:	49eebb6f1db4065b62e276f61c6f2c6abc0cb66e
SHA256:	53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e
SHA512:	739d88b2df68063eb0771cfa538bc5fdf9f3485c114c454dfa0dcce554e89cc39e3b970d689bd4c8a80ad595761a39928620cf43c05feb0aea92433870f0b8e0
SSDEEP:	6144:YFDI5CzTBC/2tX8QPfembZUrALjlX4goEjkelY2NW2UYclVyqMvhm:YWCzTM2dzPblUrAv5oSs2UZAhm
TLSH:	B574C06D72A758DAED73883CCED07A41DA7379258F21DBF706A441211E235D29C3AB23
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....}.g.........."............................@............................. ............`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14001831c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67D57DF5 [Sat Mar 15 13:17:41 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fd2739e7ebf69dea0556a52b87570850

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA2A0B933D0h
dec eax
add esp, 28h
jmp 00007FA2A0B92FF7h
int3
int3
dec eax
sub esp, 28h
call 00007FA2A0B93194h
dec eax
neg eax
sbb eax, eax
neg eax
dec eax
dec eax
add esp, 28h
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
cmp dword ptr [0001E092h], FFFFFFFFh
dec eax
mov ebx, ecx
jne 00007FA2A0B93189h
call 00007FA2A0B950B1h
jmp 00007FA2A0B93191h
dec eax
mov edx, ebx
dec eax
lea ecx, dword ptr [0001E07Ch]
call 00007FA2A0B95014h
xor edx, edx
test eax, eax
dec eax
cmove edx, ebx
dec eax
mov eax, edx
dec eax
add esp, 20h
pop ebx
ret
int3
int3
dec eax
sub esp, 18h
dec esp
mov eax, ecx
mov eax, 00005A4Dh
cmp word ptr [FFFE7C69h], ax
jne 00007FA2A0B931FAh
dec eax
arpl word ptr [FFFE7C9Ch], cx
dec eax
lea edx, dword ptr [FFFE7C59h]
dec eax
add ecx, edx
cmp dword ptr [ecx], 00004550h
jne 00007FA2A0B931E1h
mov eax, 0000020Bh
cmp word ptr [ecx+18h], ax
jne 00007FA2A0B931D6h
dec esp
sub eax, edx
movzx edx, word ptr [ecx+14h]
dec eax
add edx, 18h
dec eax
add edx, ecx
movzx eax, word ptr [ecx+06h]
dec eax
lea ecx, dword ptr [eax+eax*4]
dec esp
lea ecx, dword ptr [edx+ecx*8]
dec eax
mov dword ptr [esp], edx
dec ecx
cmp edx, ecx
je 00007FA2A0B9319Ah
mov ecx, dword ptr [edx+0Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32c78	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x38000	0x15b4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0x668	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b1e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32f08	0x268	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29aa7	0x29c00	bc39eb6dd60785e4180e7c7cbb3afa99	False	0.5047717065868264	data	6.600671819762486	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x9c0c	0x9e00	87242c2b164715b145e7eeeb049c8f17	False	0.41544699367088606	data	4.795620390693286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x2040	0xc00	da54f09d231e8fd39b1de467f9d4a7c5	False	0.17805989583333334	data	2.440587319916063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x38000	0x15b4	0x1600	092a09f2375815764b7919ab42978e4d	False	0.4836647727272727	data	5.410912571801746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x3a000	0x13e0	0x1400	07ef09fd727107c6620b60102558fa00	False	0.43828125	PGP symmetric key encrypted data - Plaintext or unencrypted data	5.090449058306497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x3c000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
_RDATA	0x3d000	0x1f4	0x200	7b11f7add986212d544d974c3e5f9c4f	False	0.53125	data	4.225546917809558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0x668	0x800	edea3649b03d6ab7210f59a9f658694e	False	0.501953125	data	4.9254112948995346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x3f000	0x22600	0x22600	a44d3d6b8acdb5a74ac904e31b852494	False	1.0003622159090908	data	7.998741666278212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileW, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwindEx, RtlVirtualUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-15T23:03:09.760882+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.7	49683	78.47.63.132	443	TCP
2025-03-15T23:03:12.380315+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	78.47.63.132	443	192.168.2.7	49685	TCP
2025-03-15T23:03:13.704468+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.7	49686	78.47.63.132	443	TCP
2025-03-15T23:03:13.704673+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	78.47.63.132	443	192.168.2.7	49686	TCP
2025-03-15T23:03:15.088957+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49687	78.47.63.132	443	TCP
2025-03-15T23:03:16.513467+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49688	78.47.63.132	443	TCP
2025-03-15T23:03:16.833330+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49689	78.47.63.132	443	TCP
2025-03-15T23:03:16.833330+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49689	78.47.63.132	443	TCP
2025-03-15T23:03:17.787767+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49690	78.47.63.132	443	TCP
2025-03-15T23:03:17.787767+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49690	78.47.63.132	443	TCP
2025-03-15T23:03:18.989094+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49691	78.47.63.132	443	TCP
2025-03-15T23:03:18.989094+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49691	78.47.63.132	443	TCP
2025-03-15T23:03:27.774448+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49718	78.47.63.132	443	TCP
2025-03-15T23:03:29.164326+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49722	78.47.63.132	443	TCP
2025-03-15T23:03:29.164326+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49722	78.47.63.132	443	TCP
2025-03-15T23:03:29.199060+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49721	78.47.63.132	443	TCP
2025-03-15T23:03:30.194612+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49723	78.47.63.132	443	TCP
2025-03-15T23:03:30.194612+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49723	78.47.63.132	443	TCP
2025-03-15T23:03:31.293963+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49724	78.47.63.132	443	TCP
2025-03-15T23:03:31.293963+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49724	78.47.63.132	443	TCP
2025-03-15T23:03:51.411177+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49776	78.47.63.132	443	TCP
2025-03-15T23:03:52.224086+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49789	78.47.63.132	443	TCP
2025-03-15T23:03:52.224086+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49789	78.47.63.132	443	TCP
2025-03-15T23:03:53.256915+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49814	78.47.63.132	443	TCP
2025-03-15T23:03:53.256915+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49814	78.47.63.132	443	TCP
2025-03-15T23:03:55.450710+0100	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49834	78.47.63.132	443	TCP
2025-03-15T23:03:55.450710+0100	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49834	78.47.63.132	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 15, 2025 23:03:04.258379936 CET	49676	80	192.168.2.7	23.199.215.203
Mar 15, 2025 23:03:04.258419037 CET	49677	443	192.168.2.7	2.18.98.62
Mar 15, 2025 23:03:06.217025042 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.217068911 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:06.217149973 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.222362041 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.222374916 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:06.840481997 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:06.840548038 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.900527954 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.900556087 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:06.900945902 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:06.900995016 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.933104038 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:06.980329990 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:07.116832972 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:07.116862059 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:07.116897106 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:07.116924047 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:07.116942883 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:07.116964102 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:07.117012024 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:07.120817900 CET	49681	443	192.168.2.7	149.154.167.99
Mar 15, 2025 23:03:07.120836020 CET	443	49681	149.154.167.99	192.168.2.7
Mar 15, 2025 23:03:07.172549009 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:07.172600031 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:07.172688961 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:07.172981977 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:07.172996044 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.009036064 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.009110928 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.015105009 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.015117884 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.015367031 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.015414000 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.015933990 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.060333014 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.461380005 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.461453915 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.461471081 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.461482048 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.461517096 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.465073109 CET	49682	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.465090036 CET	443	49682	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.467684984 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.467725039 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:08.467802048 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.468101025 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:08.468120098 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.110745907 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.110814095 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.111335993 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.111350060 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.113049030 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.113060951 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.760905981 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.760978937 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.761094093 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.761297941 CET	49683	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.761315107 CET	443	49683	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.762870073 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.762902021 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:09.762998104 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.763237000 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:09.763259888 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:10.438755035 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:10.438853025 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:10.439382076 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:10.439389944 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:10.441134930 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:10.441140890 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.094347954 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.094368935 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.094425917 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.094454050 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.094465971 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.094474077 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.094497919 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.094523907 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.094818115 CET	49684	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.094829082 CET	443	49684	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.096324921 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.096359968 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.096426964 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.096623898 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.096637011 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.738871098 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.738950014 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.739608049 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.739614964 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:11.741384029 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:11.741389036 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.380127907 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.380151987 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.380192041 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.380211115 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.380213976 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.380222082 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.380254984 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.380738020 CET	49685	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.380753040 CET	443	49685	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.382338047 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.382374048 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:12.382462978 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.382651091 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:12.382663965 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.046308994 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.046396017 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.047056913 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.047064066 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.048815966 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.048820019 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.704495907 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.704566956 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.704696894 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.705163956 CET	49686	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.705188990 CET	443	49686	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.719445944 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.719547033 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.719649076 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.719917059 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:13.719954967 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:13.867774963 CET	49676	80	192.168.2.7	23.199.215.203
Mar 15, 2025 23:03:13.867788076 CET	49677	443	192.168.2.7	2.18.98.62
Mar 15, 2025 23:03:14.378753901 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:14.378977060 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:14.379523993 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:14.379556894 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:14.381298065 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:14.381313086 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:14.381357908 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:14.381376028 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.075299978 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.075346947 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.075408936 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.075653076 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.075664997 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.088983059 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.089047909 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.089061975 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.089112997 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.089797974 CET	49687	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.089853048 CET	443	49687	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.736489058 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.736599922 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.737339020 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.737348080 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:15.739032030 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:15.739037037 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.135843992 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.135886908 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.135957003 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.136176109 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.136188984 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.513463020 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.513545990 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.513560057 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.513626099 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.514630079 CET	49688	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.514655113 CET	443	49688	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.830487967 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.830574036 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.831267118 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.831273079 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.832921982 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.832926989 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.832998991 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833008051 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833014011 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833026886 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833077908 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833077908 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833087921 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833101988 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833113909 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833120108 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833169937 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833177090 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833214998 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833228111 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833270073 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833277941 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833309889 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833317041 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833365917 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833373070 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833386898 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833395958 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833401918 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833406925 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833453894 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833462000 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833477974 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833487034 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833494902 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833503008 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833528996 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833539009 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833604097 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833611012 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833650112 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833656073 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833673954 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833679914 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833734989 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833746910 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833754063 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833756924 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833782911 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833797932 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:16.833802938 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:16.833806992 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.129165888 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.129205942 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.129280090 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.129568100 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.129581928 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.784924030 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.785001040 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.785583019 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.785593033 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.787272930 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.787277937 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.787374020 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.787391901 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.787489891 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.787512064 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:17.787595987 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:17.787604094 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.167550087 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.167642117 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.167678118 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.167689085 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.181695938 CET	49689	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.181709051 CET	443	49689	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.323373079 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.323434114 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.323499918 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.331032038 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.331047058 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.738953114 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.739021063 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.739033937 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.739154100 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.740315914 CET	49690	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.740331888 CET	443	49690	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.986370087 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.986447096 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.986958027 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.986968994 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.988653898 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.988662958 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.988744020 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.988756895 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.988799095 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.988804102 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.988882065 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.988890886 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.988945961 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.988957882 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989032984 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989043951 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989108086 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989115953 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989151955 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989162922 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989223003 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989236116 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989257097 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989276886 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989319086 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989331961 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989372969 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989382029 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989432096 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989443064 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:18.989475012 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:18.989483118 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:20.150202990 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:20.150253057 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:20.150269985 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:20.150289059 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:20.150306940 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:20.150326014 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:20.155924082 CET	49691	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:20.155944109 CET	443	49691	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:20.948512077 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:20.948542118 CET	443	49694	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:20.948596954 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:20.950634003 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:20.950649023 CET	443	49694	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:21.783976078 CET	443	49694	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:21.801537991 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.801564932 CET	443	49694	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:21.802925110 CET	443	49694	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:21.802989960 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.950083971 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.950191021 CET	443	49694	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:21.950246096 CET	49694	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.951317072 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.951353073 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:21.951399088 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.952548027 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:21.952558041 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.087800026 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.087852001 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.087975025 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.088489056 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.088516951 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.088567019 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.089303970 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.089318037 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.089951038 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.089967966 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.150230885 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.150288105 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.150484085 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.150809050 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.150824070 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.787189007 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.787420034 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.787437916 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.788642883 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.788714886 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.789984941 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.790045977 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.790326118 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.790333033 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.837132931 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.917490005 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.917793036 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.917820930 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.918524027 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.918895960 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.918914080 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.918927908 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.918986082 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.919614077 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.919673920 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.919790030 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.921478033 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.921571016 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.922010899 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.922097921 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.922247887 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.922255993 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.960326910 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.962066889 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.962068081 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.962071896 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.985450029 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.985683918 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.985713959 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.986718893 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.986777067 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.987106085 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.987170935 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:22.987413883 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:22.987423897 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.009046078 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.040206909 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.044526100 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.044610977 CET	443	49701	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.044677973 CET	49701	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.080682993 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.083666086 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.087002993 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.089288950 CET	49699	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.089306116 CET	443	49699	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230350018 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230400085 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230431080 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230463028 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230487108 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.230488062 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230504990 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.230515957 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.230979919 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.230987072 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.231134892 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.232115984 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.232124090 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.274158001 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464343071 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464363098 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464397907 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464426994 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464449883 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464473009 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464473963 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464479923 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464492083 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464514971 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464528084 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464540958 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464554071 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464562893 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464590073 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464596987 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464607000 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464643955 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464649916 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464673042 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464703083 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464731932 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464749098 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.464755058 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.464767933 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.466237068 CET	49703	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.466265917 CET	443	49703	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.470455885 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.470488071 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.470515966 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.470567942 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.470583916 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.470607996 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.471455097 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.471478939 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.471537113 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.471545935 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.471595049 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.471611977 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472465038 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472503901 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472531080 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472558022 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472563028 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.472570896 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472599030 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472604036 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.472615957 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.472620964 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.472686052 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.474280119 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.474343061 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.474364996 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.474387884 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.474430084 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.474438906 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.474478960 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.475313902 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.475366116 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.475415945 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.475423098 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.475459099 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.475465059 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.475848913 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.476027966 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.476058006 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.476085901 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.476114035 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.476174116 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.476183891 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.476224899 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.477174997 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.477204084 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.477231979 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.477257967 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.477267027 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.477272987 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.477300882 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.477320910 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.478246927 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.478368998 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.478393078 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.478420973 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.478427887 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.478468895 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.482316017 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.487246990 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.487279892 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.487298012 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.487308025 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.487557888 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.490462065 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.493709087 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.493737936 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.493782997 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.493791103 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.493827105 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.498393059 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.501199007 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.501228094 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.501260042 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.501270056 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.501313925 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.504914999 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.507019997 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.507047892 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.507070065 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.507078886 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.507323980 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.509438038 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.512286901 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.512320042 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.512346029 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.512353897 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.512399912 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.514947891 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.520823956 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.520852089 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.520878077 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.520906925 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.521130085 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.523060083 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.525883913 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.525913000 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.525928020 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.525958061 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.526304960 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.528398037 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.531084061 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.531112909 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.531135082 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.531157970 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.531394005 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.534734964 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.536400080 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.536442041 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.536461115 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.536616087 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.536696911 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:23.536741018 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.536946058 CET	49702	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:23.536957979 CET	443	49702	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:25.380618095 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:25.380665064 CET	443	49713	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:25.380820990 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:25.381179094 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:25.381191969 CET	443	49713	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:25.441272974 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:25.441299915 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:25.441401005 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:25.441663027 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:25.441678047 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.229306936 CET	443	49713	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:26.229624033 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:26.229656935 CET	443	49713	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:26.229968071 CET	443	49713	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:26.231041908 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:26.231105089 CET	443	49713	142.250.186.132	192.168.2.7
Mar 15, 2025 23:03:26.271294117 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.271521091 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.271536112 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.272641897 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.272718906 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.273581982 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.273638010 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.273855925 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.273865938 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.274394989 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:26.321384907 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.409324884 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:26.409375906 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:26.409462929 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:26.409758091 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:26.409770966 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:26.537219048 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.537277937 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.537431955 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.537444115 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.537492990 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.537626982 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.537636995 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.537646055 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.537779093 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.538142920 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.538194895 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.538281918 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.538296938 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.543263912 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.543319941 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.543328047 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.587054968 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.623224974 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.625948906 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.625976086 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.625998020 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.626010895 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.626116991 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.632230043 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.638613939 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.638643980 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.638657093 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.638665915 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.638711929 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.644712925 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.650927067 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.650952101 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.651012897 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.651022911 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.651149988 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.656924009 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.663130045 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.663156033 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.663172960 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.663182974 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.663235903 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.669078112 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.675662994 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.675719976 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.675729036 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.681417942 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.681474924 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.681483030 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.709491968 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.709522963 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.709564924 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.709578037 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.709624052 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.711796999 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.717999935 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.718027115 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.718080997 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.718091965 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.718195915 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.723999977 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.730093956 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.730149031 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.730169058 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.730180025 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.730232954 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.736259937 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.742446899 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.742495060 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.742553949 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.742564917 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.742604971 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.748744011 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.748801947 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.748851061 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.748859882 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.754621029 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.754724979 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.754745007 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.760751963 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.760921001 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.760927916 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.766647100 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.766716957 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.766724110 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.772243023 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.772324085 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.772330046 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.777173042 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.777451992 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.777468920 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.782063007 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.782124043 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.782130003 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.786597967 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.786777973 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.786787033 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.791162968 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.791208982 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.791215897 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.796233892 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.796286106 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.796293020 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.800431013 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.800545931 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.800564051 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.804920912 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.804969072 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.804977894 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.808192968 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.808250904 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.808258057 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.810525894 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.810585976 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.810592890 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.813224077 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.813287973 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.813294888 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.815890074 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.815933943 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.815939903 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.818665981 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.818713903 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.818720102 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.821213961 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.821257114 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.821268082 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.823894024 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.823941946 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.823950052 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.826889038 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.826932907 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.826940060 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.827049971 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.827150106 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:26.827157021 CET	443	49715	216.58.206.78	192.168.2.7
Mar 15, 2025 23:03:26.827179909 CET	49715	443	192.168.2.7	216.58.206.78
Mar 15, 2025 23:03:27.056631088 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.056709051 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.057399035 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.057405949 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.072514057 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.072529078 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.448606014 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.448647976 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.448898077 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.449265003 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.449275970 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.473756075 CET	49713	443	192.168.2.7	142.250.186.132
Mar 15, 2025 23:03:27.774491072 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.774545908 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:27.774570942 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.774595976 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.775505066 CET	49718	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:27.775527954 CET	443	49718	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:28.270950079 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:28.271029949 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:28.271481991 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:28.271492004 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:28.273351908 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:28.273359060 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:28.518671989 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:28.518722057 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:28.518798113 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:28.519064903 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:28.519078970 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.161464930 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.161539078 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.162203074 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.162211895 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.163889885 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.163894892 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.163955927 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.163974047 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.163980961 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.163985014 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164062977 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164079905 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164093971 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164099932 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164164066 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164180040 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164201975 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164216995 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164450884 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164474010 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164494991 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164506912 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164518118 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164524078 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164587021 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164603949 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164632082 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164647102 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.164652109 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.164659977 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.199112892 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.199173927 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.199197054 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.199213982 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.199255943 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.200122118 CET	49721	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.200134039 CET	443	49721	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.525870085 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.525924921 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:29.526002884 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.526262045 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:29.526273012 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.188072920 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.189208031 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.192392111 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.192399979 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194259882 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194264889 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194315910 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194329023 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194334030 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194338083 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194372892 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194379091 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194432974 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194442987 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194466114 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194474936 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194484949 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194490910 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194536924 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194545984 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.194556952 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.194564104 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.397444963 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.397516966 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.397706032 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.398427010 CET	49722	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.398442030 CET	443	49722	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.571518898 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.571576118 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:30.571646929 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.571871042 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:30.571882010 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.157471895 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.157546997 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.157555103 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.157598972 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.158349991 CET	49723	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.158365965 CET	443	49723	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.291228056 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.291297913 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.291757107 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.291769028 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.293533087 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.293538094 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.293622971 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.293647051 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.293718100 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.293739080 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.293843031 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.293870926 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.293986082 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294006109 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294020891 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294028044 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294073105 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294085979 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294127941 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294141054 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294173956 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294186115 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294239044 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294253111 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294277906 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294291973 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294332027 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294346094 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294384956 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294397116 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294439077 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294452906 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294481993 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294501066 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:31.294512033 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:31.294514894 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:32.633635044 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:32.633706093 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:32.633734941 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:32.633780956 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:32.765602112 CET	49724	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:32.765630960 CET	443	49724	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:41.088162899 CET	49671	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:41.400480032 CET	49671	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:42.009813070 CET	49671	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:43.212940931 CET	49671	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:44.982368946 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:44.982378006 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:44.982443094 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.013473988 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.013508081 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.620943069 CET	49671	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.715276957 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.720276117 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.720290899 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.721479893 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.721539021 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.726103067 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.726224899 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.727313042 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.727320910 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.777369022 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.845230103 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845252991 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845263004 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845304966 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.845314026 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845321894 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845331907 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845360041 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.845365047 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.845391035 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.845660925 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.848901033 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.848975897 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.932876110 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.932945967 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.932965040 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.933001995 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.933099985 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.933151007 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.933155060 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.933165073 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.933216095 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.933285952 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.933336020 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.934087038 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.934145927 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.934149027 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.934154987 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.934194088 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.934834003 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.934881926 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:45.934956074 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:45.935004950 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.008914948 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.008960962 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.009054899 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.013149977 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.013169050 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.021198034 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.021265030 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.021306992 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.021348000 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.021356106 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.021389008 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.021557093 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.034569025 CET	49733	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.034595013 CET	443	49733	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.153242111 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.153275967 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.153542995 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.154081106 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.154158115 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.154232979 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.155998945 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.156037092 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.156162977 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.156173944 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.652417898 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.705532074 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.713610888 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.766180038 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.766175985 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.769062042 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.956970930 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.956993103 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.957114935 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.957144022 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.957391977 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.957416058 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.957530022 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.957591057 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.958515882 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.958586931 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.958647966 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.958662987 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.958703995 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.959280968 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.959342957 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.960454941 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.960484982 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.960634947 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:46.960659027 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:46.961010933 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:46.961083889 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:46.961138010 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.008322001 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.060684919 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.060714006 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.060739994 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.060746908 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.060780048 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.060785055 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.060808897 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.060822964 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.060834885 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.060866117 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.063461065 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.063483953 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.063512087 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.063520908 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.063530922 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.063576937 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.063641071 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.063676119 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.063702106 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.146502018 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.146541119 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.146584988 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.146611929 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.146626949 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.146626949 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.146653891 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.146683931 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.148552895 CET	49737	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.148566008 CET	443	49737	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.149991035 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.150017023 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.150046110 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.150093079 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.150158882 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.150202036 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.150469065 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.150537014 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.161587954 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.161760092 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.162283897 CET	49735	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.162311077 CET	443	49735	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.163135052 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.163180113 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.163465023 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.163769007 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.163783073 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.187150955 CET	49738	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:47.187163115 CET	443	49738	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:47.218592882 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.218616962 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.218847990 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.218981028 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219014883 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.219109058 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219119072 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.219125032 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219182968 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219321966 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219341993 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.219461918 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219773054 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219786882 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.219934940 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.219947100 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.220237017 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.220249891 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.220504045 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.220590115 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.220603943 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.220699072 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.220712900 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.221707106 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.221720934 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.222418070 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:47.222434998 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:47.222685099 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:47.223012924 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:47.223026037 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:47.232635021 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.232645035 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.232949018 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.233393908 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.233403921 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.236329079 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:47.236356974 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:47.236423016 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:47.236715078 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:47.236726999 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:47.785887957 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.786235094 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.786248922 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.787319899 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.787379980 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.789246082 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.789308071 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.792767048 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.793047905 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.793071032 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.793420076 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.794012070 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.794085026 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.794148922 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.840323925 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:47.854115009 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.856477022 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.856978893 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.857161999 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.857302904 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.857304096 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:47.857331038 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:47.863270044 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.889652014 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.889664888 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.889880896 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.889902115 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.890023947 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.890032053 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.890690088 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.890711069 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.891015053 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.891068935 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.891227961 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.891278982 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.891799927 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.891803026 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.891913891 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.891917944 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.892004013 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.892013073 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.892932892 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.893001080 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.893248081 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.893316031 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.893316984 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.893394947 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.900593042 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.900648117 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.903839111 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.903917074 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.904934883 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.905030012 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.905555010 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.905563116 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.906114101 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.906121969 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.906362057 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.906379938 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.906457901 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.906476021 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.957674026 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.957681894 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:47.957693100 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.957694054 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.958419085 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:47.958445072 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.958463907 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:47.976016045 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:47.979599953 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:48.029333115 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:48.029347897 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:48.029449940 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:48.029465914 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:48.030869007 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:48.030869007 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:48.030881882 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:48.030930042 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:48.030976057 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:48.075171947 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:48.075241089 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:48.075562000 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:48.092494011 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.115720034 CET	49742	443	192.168.2.7	2.22.242.11
Mar 15, 2025 23:03:48.115746021 CET	443	49742	2.22.242.11	192.168.2.7
Mar 15, 2025 23:03:48.116596937 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:48.116724014 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:48.118187904 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:48.118304968 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:48.150573015 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150599003 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150607109 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150629997 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150640011 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150649071 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150672913 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.150688887 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.150712967 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.150737047 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.158459902 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158480883 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158488035 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158514023 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158524036 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158534050 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158543110 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.158554077 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.158582926 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.158602953 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.165802002 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:48.165812969 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:48.171968937 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.171993017 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.172003031 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.172017097 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.172024012 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.172027111 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.172072887 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.172092915 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.172102928 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.172132969 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.174060106 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174084902 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174093962 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174108028 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174115896 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174120903 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174139023 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.174149990 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.174180031 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.174205065 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.208699942 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.208735943 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.208765984 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.208779097 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.208806992 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.208838940 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.209048033 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:48.209060907 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:48.209755898 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.209790945 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.209860086 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.209871054 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.209904909 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.209904909 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.211302996 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.211313009 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.211333990 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.211386919 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.211416960 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.211452007 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.211497068 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.211530924 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.211575985 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.211582899 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.211584091 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.212982893 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.213289976 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.213310003 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.213366032 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.213373899 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.213423967 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.213423967 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.232048035 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.232105017 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.232125998 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.232141018 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.232182980 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.245225906 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.258106947 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.258135080 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.258193016 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.258219004 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.258251905 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.258301973 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.260149002 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.260169029 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.260209084 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.260210037 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.260225058 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.260251045 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.293795109 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.293822050 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.293874979 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.293884993 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.293925047 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295063019 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295084953 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295126915 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295139074 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295154095 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295160055 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295170069 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295221090 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295227051 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295279026 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295463085 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295516014 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295521975 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295702934 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295736074 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295766115 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295772076 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.295794964 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.295813084 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.296264887 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.296281099 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.296334982 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.296343088 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.296381950 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.297630072 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.297651052 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.297694921 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.297702074 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.297729969 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.297749043 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.297991991 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298008919 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298048019 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.298063993 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298094034 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.298188925 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.298259020 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298281908 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298316002 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.298321962 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298355103 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.298978090 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.298996925 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.299036026 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.299043894 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.299067020 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.299133062 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.299890995 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.299907923 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.299971104 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.299988031 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.300041914 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.300120115 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.300290108 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.300338984 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.318836927 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.318859100 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.318907976 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.318928003 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.318944931 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.319032907 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.319082022 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.319091082 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.319135904 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.321309090 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.321327925 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.321469069 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.321469069 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.321479082 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.321739912 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.322809935 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.322824955 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.322886944 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.322896957 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.322932959 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.353677988 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:48.353699923 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.367705107 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:48.380356073 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.380381107 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.380462885 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.380474091 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.380512953 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.380939007 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.380954027 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.380996943 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.381002903 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.381011009 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.381042957 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.381048918 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.381072998 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.381484985 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.381503105 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.381541967 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.381553888 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.381592035 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382044077 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382065058 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382112980 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382128000 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382138968 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382236004 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382262945 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382268906 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382323980 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382330894 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382375002 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382515907 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382531881 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382597923 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382605076 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382667065 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.382945061 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.382965088 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383008957 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383014917 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383044958 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383176088 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383238077 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383244038 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383297920 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383372068 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383385897 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383430004 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383450985 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383457899 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383486032 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383810997 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383830070 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383865118 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383874893 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.383905888 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.383935928 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.384243965 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.384262085 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.384309053 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.384315968 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.384337902 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.384895086 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.384907961 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.384947062 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.384952068 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.384996891 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.385966063 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.385984898 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386069059 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386076927 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386107922 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386109114 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386246920 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386261940 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386318922 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386326075 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386360884 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386360884 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386683941 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386698961 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386770010 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.386775970 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.386826992 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.394937992 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.397277117 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.406526089 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.406544924 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.406586885 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.406603098 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.406614065 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.406621933 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.406641960 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.406646013 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.406656027 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.407341003 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.407358885 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.407398939 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.407407045 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.407430887 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.408204079 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.408219099 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.408252954 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.408260107 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.408288956 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.410837889 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.410855055 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.410892963 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.410901070 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.410926104 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.411221981 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.411240101 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.411264896 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.411274910 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.411307096 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.411889076 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.411911964 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.411947966 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.411953926 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.411984921 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.412024021 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.412133932 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.412144899 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.412349939 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.412368059 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.412393093 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.412404060 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.412424088 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.418396950 CET	49744	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.418463945 CET	443	49744	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.418656111 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.418688059 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.418719053 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.418728113 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.418786049 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.418786049 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.422884941 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.422895908 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.422964096 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.436657906 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.436678886 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.436722994 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.436737061 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.436758995 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.436779022 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.461107969 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.467029095 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467045069 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467082977 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467087030 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.467092991 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467160940 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.467480898 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467494965 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467554092 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.467560053 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.467593908 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.468271017 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468286037 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468343973 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.468348980 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468394995 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.468466043 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468487024 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468523026 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468525887 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.468535900 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468550920 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.468569994 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.468944073 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.468961954 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.469019890 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.469026089 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.469271898 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.469293118 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.469322920 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.469329119 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.469364882 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.469398022 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.469455004 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470029116 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470045090 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470060110 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470107079 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470113039 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470136881 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470144033 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470158100 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470181942 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470462084 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470491886 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470516920 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470523119 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470542908 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470561981 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470618010 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470704079 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470717907 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470751047 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470756054 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.470791101 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470809937 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.470990896 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.471045971 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.471446037 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.471473932 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.471503973 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.471510887 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.471520901 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.494800091 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.494817972 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.494857073 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.494865894 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.494882107 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.494910955 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.495136976 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.495158911 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.495187044 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.495193958 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.495218039 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.495616913 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.495635986 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.495662928 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.495671034 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.495697975 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.496298075 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.496361971 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.496368885 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.496752024 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.496767044 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.496808052 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.496814966 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.496843100 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.497876883 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.497891903 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.497946024 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.497955084 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.498204947 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.498220921 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.498259068 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.498265028 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.498296976 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.498897076 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.498938084 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.498944998 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.499284029 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.499298096 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.499330997 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.499342918 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.499536037 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.524791956 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.524808884 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.524890900 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.524908066 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.524959087 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.550153017 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.553962946 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.553966999 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.553976059 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.553999901 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554024935 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554039955 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.554048061 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554097891 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.554394007 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554409027 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554450989 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.554456949 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554493904 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.554833889 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554846048 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554883003 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.554892063 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.554922104 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.554934025 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.555505991 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.555569887 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.555811882 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.555840969 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.555859089 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.555903912 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.555908918 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.555932045 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.555951118 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.556129932 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.556891918 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.556926012 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.556941986 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.556947947 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.556982040 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.557034016 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.557162046 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.564492941 CET	49746	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.564523935 CET	443	49746	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.573931932 CET	49745	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.573954105 CET	443	49745	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.582956076 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.582974911 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583019018 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583034039 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583067894 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583323002 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583337069 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583373070 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583379030 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583403111 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583420992 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583683968 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583698988 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583741903 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583749056 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.583772898 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.583789110 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.584455013 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.584525108 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.584830999 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.584846020 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.584884882 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.584892988 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.584913969 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.584928989 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.586007118 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.586021900 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.586071014 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.586083889 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.586131096 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.587095976 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.587177992 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.587516069 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.587532997 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.587582111 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.587589025 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.587755919 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.599169970 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:48.599195957 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:48.599248886 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:48.599385977 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:48.599397898 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:48.613060951 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.613076925 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.613127947 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.613143921 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.613394976 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.671175003 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671194077 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671243906 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.671250105 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671263933 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671289921 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.671427965 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671448946 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671469927 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.671478033 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671490908 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.671729088 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671742916 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671772957 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.671781063 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.671797037 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.672724009 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.672782898 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.672791004 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.673073053 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.673089027 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.673120975 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.673129082 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.673151016 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.674349070 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.674364090 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.674405098 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.674415112 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.675240993 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.675292015 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.675302029 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.675806046 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.675839901 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.675863028 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.675869942 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.675895929 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.701442957 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.701462984 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.701500893 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.701518059 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.701546907 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.758610964 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.759567022 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759577990 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759607077 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759638071 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759651899 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.759660959 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759701967 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.759905100 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759928942 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759958982 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.759968042 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.759985924 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.760174990 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.760368109 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.760416985 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.760432005 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.760438919 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.760466099 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.760481119 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.760890007 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.760947943 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.761387110 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.761405945 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.761440039 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.761449099 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.761462927 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.761486053 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.762516022 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.762545109 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.762589931 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.762597084 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.762622118 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.762639046 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.763410091 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.763467073 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.764007092 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.764039993 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.764060020 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.764065981 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.764111996 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.789602041 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.789621115 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.789666891 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.789683104 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.789714098 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.847677946 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.847702026 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.847743034 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.847748995 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.847759962 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.847760916 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.847791910 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.848041058 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.848054886 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.848088980 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.848098040 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.848124027 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.848145008 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.848474026 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.848495960 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.848526955 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.848536015 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.848558903 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.848573923 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.849138975 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.849199057 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.849545956 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.849560976 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.849596024 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.849605083 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.849617958 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.849637985 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.850750923 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.850765944 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.850833893 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.850841999 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.850969076 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.852052927 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.852132082 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.852341890 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.852376938 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.852395058 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.852401972 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.852436066 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.877810001 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.877827883 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.877870083 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.877899885 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.877914906 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.936131001 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936170101 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936211109 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.936240911 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936256886 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.936495066 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936510086 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936559916 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.936570883 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936625004 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.936923027 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936950922 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.936969995 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.936979055 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.937009096 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.937027931 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.937362909 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.937411070 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.937768936 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.937786102 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.937818050 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.937829971 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.937844992 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.937978983 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.938919067 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.938934088 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.938982010 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.938993931 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.939044952 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.940335035 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.940390110 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.940629959 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.940661907 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.940679073 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.940690994 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.940722942 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.940741062 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.966058969 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.966078043 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.966151953 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:48.966177940 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:48.966268063 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.024426937 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.024449110 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.024509907 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.024544954 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.024593115 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.024678946 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.024693966 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.024722099 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.024732113 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.024746895 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.024772882 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.025090933 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.025106907 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.025140047 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.025147915 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.025193930 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.025193930 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.025538921 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.025593996 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.025933027 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.025949001 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.025979042 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.025990009 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.026014090 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.026029110 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.027162075 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.027179003 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.027209044 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.027225971 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.027241945 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.027261019 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.028569937 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.028625965 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.028841019 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.028862953 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.028897047 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.028909922 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.028929949 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.028945923 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.035487890 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.054776907 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.054796934 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.054835081 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.054861069 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.054878950 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.055039883 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114123106 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114141941 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114182949 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114186049 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114207983 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114224911 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114239931 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114284039 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114305019 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114331007 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114340067 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114366055 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114670992 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114685059 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114727974 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114737034 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114842892 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.114896059 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.114902973 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115154982 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115169048 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115206957 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.115217924 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115797043 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115814924 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115844011 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.115854979 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.115878105 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.116785049 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.116842985 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.116867065 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.117126942 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.117165089 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.117175102 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.117183924 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.117213964 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.143030882 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.143290043 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.143310070 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.143342972 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.143354893 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.143378973 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202115059 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202136040 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202167034 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202176094 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202193022 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202205896 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202224970 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202588081 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202603102 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202652931 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202667952 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202831030 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202850103 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202873945 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202883959 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.202910900 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.202997923 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203046083 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.203054905 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203432083 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203444958 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203480959 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.203491926 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203939915 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203958988 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.203991890 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.204005003 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.204025984 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.205100060 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.205159903 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.205174923 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.205429077 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.205461025 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.205473900 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.205483913 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.205498934 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.231457949 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.231473923 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.231517076 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.231545925 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.231559038 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.233609915 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.277546883 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.279504061 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.279524088 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.280100107 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.280116081 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.280158997 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.280164957 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.280181885 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.280203104 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.280834913 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.283217907 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.283294916 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.283694983 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.283700943 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.451849937 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.451860905 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.451889992 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.451920033 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.451951981 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.451972961 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452003956 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452033043 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452431917 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452455044 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452486992 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452495098 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452511072 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452514887 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452534914 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452538013 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452552080 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452564001 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452598095 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.452799082 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.452846050 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.453099012 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453114986 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453154087 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.453160048 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453171968 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.453195095 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.453282118 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453299046 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453347921 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453377962 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.453382015 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.453408957 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.453437090 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.454025030 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.454057932 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.454077005 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.454082012 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.454106092 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.454174995 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.454204082 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.454221964 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.454230070 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.454252005 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.455008984 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455023050 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455061913 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.455069065 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455080986 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.455128908 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455144882 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455176115 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.455182076 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455203056 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.455229998 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.455960035 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.455976963 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456021070 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456041098 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456047058 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456073046 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456095934 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456157923 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456172943 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456212044 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456218958 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456372976 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.456382990 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456800938 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456825018 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456861019 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456864119 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456875086 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456891060 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456907034 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456918001 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.456923962 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.456945896 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.457010984 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.457051992 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.518317938 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.614604950 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:49.614664078 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:49.614731073 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:49.614984989 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:49.615011930 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:49.615061998 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:49.615242004 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:49.615257025 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:49.615362883 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:49.615376949 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:49.628603935 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.628648996 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.628684044 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.628691912 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.628705025 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.628777027 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.628783941 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.631748915 CET	49747	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.631763935 CET	443	49747	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.636802912 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:49.636842012 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:49.636970043 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:49.637454033 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:49.637470961 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:49.637814045 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.637862921 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.637872934 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.640990019 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.641092062 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.641098976 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.647660017 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.647699118 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.647705078 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.653798103 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.653870106 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.653877020 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.660150051 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.660200119 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.660207033 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.673007965 CET	49678	443	192.168.2.7	20.189.173.15
Mar 15, 2025 23:03:49.715641975 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.715668917 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.715713978 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.715724945 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.715785980 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.718811989 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.725167990 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.725195885 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.725243092 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.725250959 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.725303888 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.731409073 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.737929106 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.737962008 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.737973928 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.737982988 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.738231897 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.744240999 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.750530005 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.750586033 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.750603914 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.750618935 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.750853062 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.756956100 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.763211012 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.763271093 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.763278961 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.765961885 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.765985012 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.766079903 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.766603947 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.766618013 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.769001961 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.769032001 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.769057989 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.769064903 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.769104004 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.774748087 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.780469894 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.780508041 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.780528069 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.780535936 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.780581951 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.786135912 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.789082050 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:49.789109945 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:49.789179087 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:49.789875031 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:49.789907932 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:49.789994955 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:49.791927099 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.791955948 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.791979074 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.791994095 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.792035103 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.797122955 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:49.797153950 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:49.798383951 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.798523903 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:49.798538923 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:49.801002026 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.801037073 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.801282883 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.801282883 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.801314116 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.802177906 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:49.803198099 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.803239107 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.803241014 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.803250074 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.803283930 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.810969114 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.813215971 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.813246965 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.813262939 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.813271999 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.813318014 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.817461014 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.821698904 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.821772099 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.821779013 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.825938940 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.825974941 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.826006889 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.826014996 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.826056957 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.830099106 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.834202051 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.834242105 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.834266901 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.834275007 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.834311962 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.837719917 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.841600895 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.841666937 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.841675043 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.845577955 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.845623970 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.845630884 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.848326921 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.849018097 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.849045038 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.849075079 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.849095106 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.849133968 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.852824926 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.856844902 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.856877089 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.856919050 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.856930971 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.856971025 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.860455036 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.864238977 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.864286900 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.864331961 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.864341021 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.864381075 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.867794991 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.871669054 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.871699095 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.871711016 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.871716976 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.871745110 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.875163078 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.878592968 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.878659964 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.878667116 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.881983042 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.882138014 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.882164001 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.882170916 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.882205963 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.885339975 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.888750076 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.888782978 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.888868093 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.888880014 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.888919115 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.892071009 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.895241976 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.895273924 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.895282984 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.895289898 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.895327091 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.895333052 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.898571968 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.898643017 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.898649931 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.900527000 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.900568962 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.900574923 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.902704954 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.902759075 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.902770042 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.904886007 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.904922009 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.904927015 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.906985044 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.907051086 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.907058001 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.908998966 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.909070969 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.909077883 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.911206007 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.911250114 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.911256075 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.913233042 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.913295031 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.913300991 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.915831089 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.915882111 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.916076899 CET	49758	443	192.168.2.7	142.250.185.65
Mar 15, 2025 23:03:49.916091919 CET	443	49758	142.250.185.65	192.168.2.7
Mar 15, 2025 23:03:49.990570068 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.991290092 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:49.991338968 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.017033100 CET	49748	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.017050028 CET	443	49748	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.056248903 CET	49678	443	192.168.2.7	20.189.173.15
Mar 15, 2025 23:03:50.090723038 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.091026068 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.091053963 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.091788054 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.092017889 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.092030048 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.092108965 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.092169046 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.093101978 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.093149900 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.117950916 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.118321896 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.118340015 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.119379997 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.119435072 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.122338057 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.122495890 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.122971058 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.123054028 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.123349905 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.123416901 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.123471975 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.123491049 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.123578072 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.123589993 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.123636961 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.123644114 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.149748087 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.149785042 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:50.149908066 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.152508020 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.152522087 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:50.165637016 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.165743113 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.165745974 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.236625910 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.236709118 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.236819983 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.237303019 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.237380981 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.237437963 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.237803936 CET	49764	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.237822056 CET	443	49764	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.238091946 CET	49765	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.238106966 CET	443	49765	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.247148037 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.247212887 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.247258902 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.249629974 CET	49767	443	192.168.2.7	162.159.61.3
Mar 15, 2025 23:03:50.249648094 CET	443	49767	162.159.61.3	192.168.2.7
Mar 15, 2025 23:03:50.346848965 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.347554922 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.347572088 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.347912073 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.348735094 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.348799944 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.371515036 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.371978998 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.371995926 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.372370958 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.372926950 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.372996092 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.399955034 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.400252104 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.400273085 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.400616884 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.401007891 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.401098967 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.443360090 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.443697929 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.443722963 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.444075108 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.444726944 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.444802999 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.449754000 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.449896097 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.465040922 CET	49671	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.465166092 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.558811903 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.653733015 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:50.653775930 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.653800011 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.653830051 CET	443	49769	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.653831005 CET	443	49750	150.171.27.12	192.168.2.7
Mar 15, 2025 23:03:50.653873920 CET	443	49772	2.22.242.89	192.168.2.7
Mar 15, 2025 23:03:50.653893948 CET	49769	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.653920889 CET	49750	443	192.168.2.7	150.171.27.12
Mar 15, 2025 23:03:50.653923988 CET	49772	443	192.168.2.7	2.22.242.89
Mar 15, 2025 23:03:50.654319048 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:50.654445887 CET	443	49749	13.74.129.1	192.168.2.7
Mar 15, 2025 23:03:50.654489040 CET	49749	443	192.168.2.7	13.74.129.1
Mar 15, 2025 23:03:50.655180931 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.655226946 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.655240059 CET	443	49770	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.655266047 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:50.655287027 CET	49770	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.655301094 CET	443	49771	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:50.655333996 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:50.655347109 CET	49771	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:50.655492067 CET	443	49752	18.244.18.32	192.168.2.7
Mar 15, 2025 23:03:50.655524969 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:50.655549049 CET	49752	443	192.168.2.7	18.244.18.32
Mar 15, 2025 23:03:50.668209076 CET	49678	443	192.168.2.7	20.189.173.15
Mar 15, 2025 23:03:50.816497087 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:50.816589117 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.817884922 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.817888975 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:50.820065022 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.820069075 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:50.820158005 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:50.820164919 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:50.975080967 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.975128889 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.975270033 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.975366116 CET	49779	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.975405931 CET	443	49779	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.975649118 CET	49779	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.975806952 CET	49780	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.975842953 CET	443	49780	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.975888968 CET	49780	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.985332966 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.985385895 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.985451937 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.985788107 CET	49780	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.985816956 CET	443	49780	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.985935926 CET	49779	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.985965967 CET	443	49779	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.986048937 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.986064911 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:50.987641096 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:50.987652063 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.002345085 CET	49782	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.002361059 CET	443	49782	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.002481937 CET	49782	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.002536058 CET	49783	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.002557039 CET	443	49783	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.002613068 CET	49783	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.002763987 CET	49782	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.002779007 CET	443	49782	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.002866030 CET	49783	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.002873898 CET	443	49783	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.208642006 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.208686113 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.208739042 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.209086895 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.209095001 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.234524965 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.234553099 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.234606981 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.235573053 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.235589981 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.411200047 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:51.411274910 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.411283970 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:51.411307096 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:51.411331892 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.411355019 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.442430019 CET	443	49780	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.447324038 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.448972940 CET	443	49779	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.454015017 CET	443	49783	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.458192110 CET	49780	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.458209038 CET	443	49780	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.458626986 CET	443	49780	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.460119009 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.460133076 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.460283041 CET	49779	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.460314035 CET	443	49779	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.460728884 CET	443	49779	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.461198092 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.461298943 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.461422920 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:51.461457968 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:51.461544991 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:51.461833954 CET	49783	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.461849928 CET	443	49783	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.462244034 CET	443	49783	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.465207100 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:51.465244055 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:51.467386961 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.469829082 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.469837904 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.470179081 CET	49780	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.470243931 CET	49779	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.470276117 CET	443	49780	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.470335960 CET	443	49779	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.470375061 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.470489979 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.470815897 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.470916986 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.471414089 CET	49783	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.471514940 CET	443	49783	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.471808910 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.471859932 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.473016977 CET	49776	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.473031998 CET	443	49776	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:51.474427938 CET	443	49782	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.477762938 CET	49782	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.477771997 CET	443	49782	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.478130102 CET	443	49782	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.479937077 CET	49782	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.480010033 CET	443	49782	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.568675041 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.568711042 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:51.568938017 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.569144011 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:51.569156885 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:51.658978939 CET	49783	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.659033060 CET	49782	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.667556047 CET	49780	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.667567015 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.667572021 CET	49779	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.667582989 CET	443	49781	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.667591095 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.667603016 CET	443	49778	172.64.41.3	192.168.2.7
Mar 15, 2025 23:03:51.715558052 CET	49798	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.715600014 CET	443	49798	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.715823889 CET	49798	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.716088057 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.716111898 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.716382980 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.716415882 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.716418982 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.716561079 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.716794968 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.716819048 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.716973066 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.717219114 CET	49798	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.717236042 CET	443	49798	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.717488050 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.717499971 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.717673063 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.717689037 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.717797995 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:51.717811108 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:51.780288935 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.780965090 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.780976057 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.782057047 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.782123089 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.783236980 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.783298016 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.783505917 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.783514023 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.783531904 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.783541918 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.811553001 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.812901974 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.812922001 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.814066887 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.814131975 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.815294981 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.815371037 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.815536976 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.815546036 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.870572090 CET	49781	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.870580912 CET	49778	443	192.168.2.7	172.64.41.3
Mar 15, 2025 23:03:51.870584965 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.870595932 CET	49678	443	192.168.2.7	20.189.173.15
Mar 15, 2025 23:03:51.870598078 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.892780066 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.892853022 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.893059969 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.896372080 CET	49785	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:51.896394014 CET	443	49785	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:51.985407114 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.985518932 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:51.985586882 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.987472057 CET	49786	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:51.987493038 CET	443	49786	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:52.020339012 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.020669937 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.020692110 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.021866083 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.021933079 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.022972107 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.023034096 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.023243904 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.023256063 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.140566111 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.140636921 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.172750950 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.173240900 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.173264980 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.174345970 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.174413919 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.175523043 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.175591946 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.180392027 CET	49788	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.180422068 CET	443	49788	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.191312075 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.191346884 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.191628933 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.192718983 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.193213940 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.193221092 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.193681002 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.193691969 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.194278955 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.194329023 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.196118116 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.196191072 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.196480989 CET	443	49798	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.196696043 CET	49798	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.196705103 CET	443	49798	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.197033882 CET	443	49798	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.200129986 CET	49798	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.200206041 CET	443	49798	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.202265978 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.204794884 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.204804897 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.205830097 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.205881119 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.207505941 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.207564116 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.218571901 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.218934059 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.221508980 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.221515894 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.223638058 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.223643064 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.223723888 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.223736048 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.223783970 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.223789930 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.223886013 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.223895073 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.223902941 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.223915100 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.223990917 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224000931 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.224088907 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224096060 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.224107981 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224118948 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.224199057 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224205971 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.224231005 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224239111 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.224392891 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224400043 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.224637985 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.224647999 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225091934 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225099087 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225194931 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225205898 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225545883 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225554943 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225718975 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225738049 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225745916 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225749969 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225768089 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225780964 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225836992 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225846052 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225898027 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225909948 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.225944042 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.225955009 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.226001024 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.226012945 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.226041079 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.226052999 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.227045059 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.227057934 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.227097988 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.227109909 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.230905056 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.230922937 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.230937958 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.230946064 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.230957985 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.230961084 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.231221914 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.231226921 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.261827946 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.261840105 CET	49798	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.261841059 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.261848927 CET	443	49800	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.261854887 CET	443	49799	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.261878967 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.261893988 CET	443	49801	23.204.152.9	192.168.2.7
Mar 15, 2025 23:03:52.368537903 CET	49800	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.368622065 CET	49801	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.368623018 CET	49799	443	192.168.2.7	23.204.152.9
Mar 15, 2025 23:03:52.577336073 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:52.577385902 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:52.577445030 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:52.577954054 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:52.577995062 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:52.578227997 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:52.578509092 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:52.578526974 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:52.579112053 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:52.579123974 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:52.579854012 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:52.579895020 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:52.579955101 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:52.580991030 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:52.581007004 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:52.581620932 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:52.581650019 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:52.581698895 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:52.582122087 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:52.582132101 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:52.585697889 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.585730076 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.585817099 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.586321115 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:52.586338997 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:52.615827084 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:52.615844011 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:52.615935087 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:52.616177082 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:52.616208076 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:52.616261959 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:52.616452932 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:52.616463900 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:52.616817951 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:52.616838932 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:52.683010101 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:52.683053970 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:52.683237076 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:52.683785915 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:52.683803082 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:52.744319916 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.744549990 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.744565964 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.744961977 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.745773077 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.745834112 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.745934010 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.788326025 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.815330982 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:52.815361977 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:52.815635920 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:52.815857887 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:52.815867901 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:52.858661890 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.858746052 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.858849049 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.913106918 CET	49803	443	192.168.2.7	18.164.96.18
Mar 15, 2025 23:03:52.913130045 CET	443	49803	18.164.96.18	192.168.2.7
Mar 15, 2025 23:03:52.971076965 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:52.971127033 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:52.971322060 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:52.971718073 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:52.971733093 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:52.976327896 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:52.976372957 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:52.976505041 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:52.976969004 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:52.976984978 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.031899929 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.032217979 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.032234907 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.033299923 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.033358097 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.034463882 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.034528971 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.071640015 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.072750092 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.072781086 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.073956966 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.074004889 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.074332952 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.074405909 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.127149105 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.127172947 CET	443	49811	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.127209902 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.127240896 CET	443	49810	23.44.201.26	192.168.2.7
Mar 15, 2025 23:03:53.160337925 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.164561033 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.165266037 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:53.168468952 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.168482065 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.168598890 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.168632030 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.168816090 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:53.168824911 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:53.169560909 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.169616938 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.169658899 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.169708014 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.170140982 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:53.170192957 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:53.170861959 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.170922041 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.171361923 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.171431065 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.172527075 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:53.172593117 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:53.173882961 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.174287081 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.174315929 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.175355911 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.175438881 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.176973104 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.177031994 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.177395105 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.177405119 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.191555977 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.191771984 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.191797018 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.195451975 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.195519924 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.195853949 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.196026087 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.196610928 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.254378080 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.254426956 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.254774094 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.254780054 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256396055 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256401062 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256434917 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256445885 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256459951 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256464005 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256532907 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256550074 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256555080 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256561041 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256803036 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256824970 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.256963968 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.256983995 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.260595083 CET	49811	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.260612011 CET	49810	443	192.168.2.7	23.44.201.26
Mar 15, 2025 23:03:53.260612011 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:53.260638952 CET	443	49817	23.44.201.25	192.168.2.7
Mar 15, 2025 23:03:53.288417101 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.288815022 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:53.288830042 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.289190054 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.289659023 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:53.289725065 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.289894104 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:53.290913105 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.290978909 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.290983915 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.290994883 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.291028976 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.291037083 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.291090965 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.291134119 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.291138887 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.291172028 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.294955015 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.295008898 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.329555035 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.329569101 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.329621077 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.329632044 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.329973936 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.329981089 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.330013037 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.330020905 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.330034971 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.330056906 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.332325935 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.333996058 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.334041119 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.334048033 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.334083080 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.362014055 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.362014055 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.362035990 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.362046003 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.362046957 CET	443	49812	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.362071037 CET	443	49813	204.79.197.219	192.168.2.7
Mar 15, 2025 23:03:53.369950056 CET	49817	443	192.168.2.7	23.44.201.25
Mar 15, 2025 23:03:53.376847029 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.376924992 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.377059937 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.377105951 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.377685070 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.377728939 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.377737999 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.377768993 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.377787113 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.378287077 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.378336906 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.378343105 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.378385067 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.378943920 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.378998995 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.379039049 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.379095078 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.417857885 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.417875051 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.417901993 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.417938948 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.417975903 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.418623924 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.418632030 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.418687105 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.419478893 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.419487000 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.419543028 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.419555902 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.420324087 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.420365095 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.420371056 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.420382977 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.420398951 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.420406103 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.420444012 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.420449018 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.453727961 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.453953981 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.454005003 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:53.463572025 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.463623047 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.463776112 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.463814974 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.463824034 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.463907957 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.463951111 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.464529037 CET	49812	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.464538097 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.464545965 CET	49813	443	192.168.2.7	204.79.197.219
Mar 15, 2025 23:03:53.464562893 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.468220949 CET	49815	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.468240976 CET	443	49815	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.473495007 CET	49818	443	192.168.2.7	20.110.205.119
Mar 15, 2025 23:03:53.473520041 CET	443	49818	20.110.205.119	192.168.2.7
Mar 15, 2025 23:03:53.506227016 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506273985 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506282091 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506283998 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.506326914 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.506325960 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506620884 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506664038 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.506675005 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506685972 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506735086 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.506743908 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.506789923 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.507447004 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.507453918 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.507510900 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.507517099 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.507559061 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.507599115 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.507605076 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.507719040 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.508404970 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.508450985 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.508517027 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.508567095 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.508573055 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.508610964 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.509259939 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.509308100 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.509318113 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.509356976 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.509362936 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.509370089 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.509391069 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.510152102 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.510205030 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.510215044 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.510360956 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.510413885 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.558662891 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.559839010 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.562230110 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.562239885 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.562510014 CET	49816	443	192.168.2.7	204.79.197.203
Mar 15, 2025 23:03:53.562521935 CET	443	49816	204.79.197.203	192.168.2.7
Mar 15, 2025 23:03:53.562624931 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.564819098 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.564888954 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.565174103 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.565231085 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.565289021 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.632554054 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.632611036 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.632641077 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.632673979 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.632715940 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.634181023 CET	49789	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:53.634212017 CET	443	49789	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:53.736834049 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.736876965 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.736959934 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.737318993 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.737329960 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.792202950 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.792325020 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.792403936 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.796469927 CET	49820	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.796505928 CET	443	49820	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.836513996 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.837095022 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.837136984 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.837521076 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.838284969 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.838356972 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.838579893 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.838615894 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.838664055 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.974165916 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.974215031 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:53.974278927 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.974565029 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:53.974579096 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.312406063 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.312644005 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.312664032 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.313025951 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.313427925 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.313500881 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.313590050 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.313632011 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.313658953 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.321980000 CET	49678	443	192.168.2.7	20.189.173.15
Mar 15, 2025 23:03:54.387758970 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:54.387826920 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:54.387835979 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:54.387893915 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:54.398523092 CET	49814	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:54.398533106 CET	443	49814	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:54.436578035 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.436670065 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.436724901 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.437206984 CET	49819	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.437215090 CET	443	49819	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.539164066 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.539446115 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.539469004 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.539818048 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.540519953 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.540586948 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.540699959 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.540777922 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.540811062 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.656559944 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.656634092 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.656711102 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.660526991 CET	49831	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.660532951 CET	443	49831	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.730940104 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.731015921 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.731203079 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.731482983 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.731501102 CET	443	49830	52.168.117.175	192.168.2.7
Mar 15, 2025 23:03:54.731508970 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.731539965 CET	49830	443	192.168.2.7	52.168.117.175
Mar 15, 2025 23:03:54.799274921 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:54.799302101 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:54.799370050 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:54.799917936 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:54.799932957 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.447237015 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.447303057 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.447945118 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.447957039 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450110912 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450117111 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450206041 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450222015 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450227976 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450232983 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450299978 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450318098 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450330973 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450340033 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450366974 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450376034 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450613976 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450628996 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450649977 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450670004 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450716972 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450730085 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450738907 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450746059 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450762033 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450774908 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450807095 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450829029 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.450865984 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.450879097 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451009989 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451023102 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451046944 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451062918 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451184034 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451198101 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451248884 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451261997 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451353073 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451366901 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451400042 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451412916 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451461077 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451472044 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451517105 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451525927 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451590061 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451601982 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451607943 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451611996 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451636076 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451647043 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451885939 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451899052 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451904058 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451906919 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451936007 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.451952934 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.451992035 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452003956 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452047110 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452058077 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452066898 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452071905 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452088118 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452094078 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452238083 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452250004 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452267885 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452285051 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452430010 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452438116 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452455997 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452466965 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.452560902 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452609062 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452666044 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452708006 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.452753067 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.460313082 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.460581064 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.460602999 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.460639954 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.460694075 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.460742950 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.460783958 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.460833073 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466124058 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466304064 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466330051 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466350079 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466367006 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466381073 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466439009 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466456890 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466479063 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466491938 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466547012 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466561079 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466593981 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466617107 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466643095 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466660976 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.466667891 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466692924 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466741085 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466795921 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466835976 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466876984 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466907978 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.466964006 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.467011929 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.467051983 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.471342087 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.471851110 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.471864939 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.471961975 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.471973896 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.472024918 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472040892 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.472341061 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472353935 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.472425938 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472472906 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472486019 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472508907 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472553968 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472661018 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.472692013 CET	49834	443	192.168.2.7	78.47.63.132
Mar 15, 2025 23:03:55.472700119 CET	443	49834	78.47.63.132	192.168.2.7
Mar 15, 2025 23:03:55.472714901 CET	49834	443

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_94a9958376cb9b9d82c2fdf0596f2ab52c2584_a6fb66b6_32cab553-2fd8-4028-9fae-40f8edef13dc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B32.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DC3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E9F.tmp.xml

C:\ProgramData\w47qq\c2vsr1

C:\ProgramData\w47qq\g4op8g

C:\ProgramData\w47qq\glf379z5p

C:\ProgramData\w47qq\h4euai

Windows Analysis Report
file.exe